Release 0.23.0

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

.cargo/mutants.toml

@@ -0,0 +1,14 @@
+# cargo-mutants (docs/mutation-testing.md). Mutants are judged by the black-box suites that will
+# outlive the kernel backend: the reference tests (tests/oracle, through the oracle_cases test)
+# and the pull-request sample of the robustness goldens (every 8th seed, as ci.yml). The
+# kernel's own unit tests are left out on purpose: a mutant only they catch is a behaviour the
+# backend-neutral suites would miss when the kernel is swapped.
+profile = "mutants"
+additional_cargo_test_args = [
+    "--test", "oracle_cases", "--lib", "--", "--include-ignored",
+    "oracle_suite",
+    "robustness_goldens::seed_00", "robustness_goldens::seed_08", "robustness_goldens::seed_16",
+    "robustness_goldens::seed_24", "robustness_goldens::seed_32", "robustness_goldens::seed_40",
+    "robustness_goldens::seed_48", "robustness_goldens::seed_56", "robustness_goldens::seed_64",
+    "robustness_goldens::seed_72", "robustness_goldens::seed_80", "robustness_goldens::seed_88",
+]

.config/nextest.toml

@@ -1,8 +1,8 @@
 # cargo-nextest settings for CI (`cargo xtask test` does not use nextest).
-# PR runs build the tests once and run them in 4 shards (.github/workflows/ci.yml).
+# CI builds the tests once and runs them in one job on a 32 vCPU runner (.github/workflows/ci.yml).
 
 [profile.ci]
-# Heavy tests (one to four minutes each on a CI runner) that pull requests skip. They run on
+# Heavy tests (one to twelve minutes each on a CI runner) that pull requests skip. They run on
 # every push to main and nightly (`--ignore-default-filter`), and in `cargo xtask test`. The
 # boolean_props property tests run only nightly (ci.yml excludes them from pushes to main).
 # Keep this list in sync with docs/book/src/dev/testing.md and CONTRIBUTING.md.
@@ -17,6 +17,7 @@ not (
         | test(=cmd::plastic::tests::enclosure_snap_fit_follows_resized_front_wall)
     ))
     | (package(solidcraft-kernel) & test(=tests::boolean_identity_on_tangent_primitives))
+    | (package(solidcraft-kernel) & test(=tspline::tests::hostile_tsplines_never_panic))
     | (package(solidcraft-kernel) & binary(boolean_props))
     | (package(solidcraft-engine) & binary(atomic_commands))
     | (package(solidcraft-ui-egui) & binary(scenarios) & test(=acceptance_sensor_enclosure))
@@ -32,10 +33,95 @@ slow-timeout = { period = "60s" }
 [profile.ci.junit]
 path = "junit.xml"
 
-# The action matrix sample runs its designs in parallel worker processes, one per CPU. Run with
-# other tests beside it (the heavy ones on main), a pi-case hole that takes 8 s alone (#952 makes
-# it a real hole) went past the matrix's 90 s action limit. It runs on its own.
+# The action matrix sample runs its designs in parallel workers (ACTION_MATRIX_JOBS, set to match in
+# ci.yml). Its workers reserve that many of nextest's threads, so the cores are not oversubscribed
+# (a pi-case hole that takes 8 s alone went past the matrix's 90 s action limit when they were),
+# and it starts first, beside the other slow tests.
 [[profile.ci.overrides]]
 filter = "binary(action_matrix) & test(=action_matrix_sample)"
-threads-required = "num-cpus"
+threads-required = 12
+priority = 100
 
+# The slowest tests start first, so a shard does not end with one of them running alone on a
+# core while the others sit idle (seed_81 alone takes about 20 minutes under CI load). Medians
+# from the CI test timings (the junit artifacts), slowest first; a test over ~100 s belongs here.
+[[profile.ci.overrides]]
+filter = """
+(package(solidcraft-engine) & (
+    test(/^tests::robustness_goldens::seed_(81|45|20|24|95|02|57|40|18|48|32|46|85|61)$/)
+    | test(/^tests::robustness::/)
+    | test(=tests::hostile_params_never_panic)
+    | test(=cmd::clearance::tests::distances_are_exact_on_edges_and_curved_faces)
+    | test(=cmd::clipboard::tests::a_pasted_coil_joins_the_pasted_body)
+    | test(=tests::pleat_join::the_pleats_join_at_every_wall_from_2_4_to_2_6_mm)
+    | test(=tests::flush_join_loft::a_flange_flush_with_the_end_of_a_bent_tapered_tube_joins)
+    | test(=cmd::sheet::tests::perforated_sheet_takes_a_thousand_round_holes)
+    | test(=boolean_regression_tests::joined_loft_frames_plan_their_display_at_every_quality)
+))
+| (package(solidcraft-engine) & (binary(atomic_commands) | binary(step_export_regressions)))
+| (package(solidcraft-kernel) & (
+    test(=curveblend::tests::rolling_ball_turns_about_a_rounded_corner_of_its_radius)
+    | test(=tests::fillet_tabbed_plate_outer_loop_and_partial_selection_after_hole)
+    | test(=tspline::tests::hostile_tsplines_never_panic)
+    | test(=fill::tests::regular_rims_of_three_to_eight_sides_fill_with_one_face_and_close_the_cup)
+    | test(/^issue_788_tests::equal_bores_crossing_/)
+))
+"""
+priority = 100
+
+# Each nextest test has its own process/device. Concurrent cold lavapipe path
+# compiles contend for CPU and can exhaust the 600 s pipeline setup budget.
+# Serialize this module per CI shard; other tests retain their normal parallelism.
+[test-groups.gpu-path]
+max-threads = 1
+
+[[profile.ci.overrides]]
+filter = "package(=solidcraft-gpu) & test(/^path::/)"
+test-group = "gpu-path"
+
+# Full local validation opts into its own scheduling policy. Keep GitHub CI's
+# worker reservation and slow-test priorities above independent of this runner.
+[profile.local-ci]
+inherits = "ci"
+
+[[profile.local-ci.overrides]]
+filter = "binary(action_matrix) & test(=action_matrix_sample)"
+threads-required = "num-cpus"
+priority = 100
+
+[[profile.local-ci.overrides]]
+filter = "(package(solidcraft-engine) & test(=tests::robustness_goldens::seed_81)) | (package(solidcraft-kernel) & test(=tspline::tests::hostile_tsplines_never_panic))"
+priority = 99
+
+[[profile.local-ci.overrides]]
+filter = """
+(package(solidcraft-engine) & (
+    test(/^tests::robustness_goldens::seed_(81|45|20|24|95|02|57|40|18|48|32|46|85|61)$/)
+    | test(/^tests::robustness::/)
+    | test(=tests::hostile_params_never_panic)
+    | test(=cmd::clearance::tests::distances_are_exact_on_edges_and_curved_faces)
+    | test(=cmd::clipboard::tests::a_pasted_coil_joins_the_pasted_body)
+    | test(=tests::pleat_join::the_pleats_join_at_every_wall_from_2_4_to_2_6_mm)
+    | test(=tests::flush_join_loft::a_flange_flush_with_the_end_of_a_bent_tapered_tube_joins)
+    | test(=cmd::sheet::tests::perforated_sheet_takes_a_thousand_round_holes)
+    | test(=boolean_regression_tests::joined_loft_frames_plan_their_display_at_every_quality)
+))
+| (package(solidcraft-engine) & (binary(atomic_commands) | binary(step_export_regressions)))
+| (package(solidcraft-kernel) & (
+    test(=curveblend::tests::rolling_ball_turns_about_a_rounded_corner_of_its_radius)
+    | test(=tests::fillet_tabbed_plate_outer_loop_and_partial_selection_after_hole)
+    | test(=tspline::tests::hostile_tsplines_never_panic)
+    | test(=fill::tests::regular_rims_of_three_to_eight_sides_fill_with_one_face_and_close_the_cup)
+    | test(/^issue_788_tests::equal_bores_crossing_/)
+))
+"""
+priority = 98
+
+# Native Windows shader/device creation must not overlap within the local run.
+[test-groups.windows-gpu]
+max-threads = 1
+
+[[profile.local-ci.overrides]]
+platform = "cfg(windows)"
+filter = "package(solidcraft-gpu) | package(solidcraft) | (package(solidcraft-ui-egui) & test(/(offscreen|gpu)/))"
+test-group = "windows-gpu"

.gitattributes

@@ -0,0 +1,3 @@
+# Preserve canonical source receipts and the runtime icon-discovery snapshot.
+.gitattributes text eol=lf
+/assets/icons/ui/design/requested_icons.txt text eol=lf

.github/ISSUE_TEMPLATE/bug.yml

@@ -19,6 +19,7 @@ body:
       label: Steps to reproduce
       description: |
         What you clicked or typed, in order. For a problem on a particular design, `solidcraft-cli script design.solidcraft --out repro.json` turns its history into a script that `solidcraft-cli eval repro.json` replays; attach it, trimmed to the failing step if you can.
+        Using an AI agent with SolidCraft's MCP server? The `solidcraft-reporting` skill in [`skills/`](https://github.com/tangency-labs/solidcraft/tree/main/skills) has it reproduce the problem in a fresh design and write these steps for you.
       placeholder: |
         1. Sketch a circle on the XY plane
         2. Extrude it 10 mm

.github/actionlint.yaml

@@ -2,3 +2,10 @@ self-hosted-runner:
   labels:
     - self-hosted-fast
     - self-hosted-light
+    # Blacksmith (see the top of workflows/ci.yml).
+    - blacksmith-2vcpu-ubuntu-2404
+    - blacksmith-4vcpu-ubuntu-2404
+    - blacksmith-8vcpu-ubuntu-2404
+    - blacksmith-16vcpu-ubuntu-2404
+    - blacksmith-32vcpu-ubuntu-2404
+    - blacksmith-8vcpu-windows-2025

.github/pull_request_template.md

@@ -2,6 +2,12 @@
 
 Describe the problem and resulting behavior. Link the issue when applicable.
 
+Changes a default: no
+
+<!-- Required line, replace "no" if this changes what a user gets out of the box (a default value, key binding, setting, tool behaviour):
+Changes a default: yes — <what>, old behaviour kept behind preference <name>
+Docs-only and bot PRs are exempt. -->
+
 ## Validation
 
 What did you run, and what were the results? Include expected and measured values for geometry changes.

.github/workflows/ci.yml

@@ -2,38 +2,50 @@
 # PRs test what they touch; main and nightly test everything. On a pull request the "Select
 # checks" job maps the changed files to workspace packages (scripts/ci/affected.py), adds the
 # packages that depend on them, and Clippy, the test archive and the test shards cover only
-# those. Changes to the lockfile, root manifest, toolchain/cargo/nextest config, .github/,
-# vendor/, tests/, scripts/ or any file no package owns select the whole workspace, as do
-# pushes to main, the nightly run and Run workflow.
-# Tests are built once and run in 4 shards. A few heavy tests (see .config/nextest.toml) are
+# those. Test data under tests/, vendored crates under vendor/ and root files a crate embeds
+# select the packages that read them. Changes to the lockfile, root manifest,
+# toolchain/cargo/nextest config, this workflow, scripts/ or any file no package owns select the
+# whole workspace, as do pushes to main that change code, the nightly run and Run workflow.
+# Documentation, packaging, the other workflows and the GitHub bots' scripts select nothing:
+# no native job runs for them, on pull requests or on main.
+# Tests are built and run in one job on a big runner, slowest first, starting beside the repository
+# checks (no archive to upload and download). A few heavy tests (see .config/nextest.toml) are
 # skipped on pull requests and run on pushes to main and nightly. The Windows jobs (D3D12 shaders
-# and app startup) run on pull requests only when what they test changes (the GPU crate, the app,
-# the viewport's GPU glue, the graphics dependencies, their scripts or this file); main and
-# nightly always run them. Only main saves the build caches; pull requests restore them.
-# The merge queue runs the full suite on exactly the commit it then puts on main, so a push to
-# main that a passing merge-queue run already tested runs only the repository checks; a push
-# that skipped the queue still runs everything. Pull requests run the reference tests when the
-# command line (or anything it depends on) changes, and doc tests for the affected packages.
+# and app startup), the reference tests and the doc tests run on main and nightly only, not on
+# pull requests (the fast lane, in Select checks); a break there is fixed forward on main. Only
+# main saves the build caches; pull requests restore them. sccache is on a Blacksmith sticky disk that
+# only main commits.
+# A push to main runs only the repository checks when a passing merge-queue run tested that very
+# commit, or when nothing a build reads changed since the last push to main whose run passed.
+# Otherwise it runs everything.
+# Heavy checks wait for review: a pull request without the `approved-for-ci` label runs only
+# Select checks, the format and repository checks and a quick compile. Adding the label (after
+# review) runs everything above, and every later push to the PR does too, except a push that only
+# merges main into a change that already passed (scripts/ci/main_merge.py): it carries that
+# result and runs the repository checks. Merge groups, the nightly run and Run workflow are not
+# pull requests and always run the full suite.
+# GitHub cannot filter `labeled` events by label name, so any other label starts a run whose jobs
+# are all skipped; it gets its own concurrency group (below) so it never cancels the real run. Its
+# `ci` job still runs and reports the commit's real result (see the `ci` job): the merge queue
+# reads `ci` from the newest run of a commit, so a run without it would block a PR that passed.
 # Cross-compilation is opt-in through Run workflow; release builds remain in release.yml.
-# Trusted runs use both pools: pushes to main, merge-queue groups and pull requests from a branch
-# of this repository (people with write access; fork pull requests never run on this machine).
-# There, Select checks and ci run on the self-hosted light runner (`self-hosted-light`, quick
-# jobs, so they never wait behind a build), and the repository checks, Clippy, the doc tests,
-# the reference tests and all four test shards on the self-hosted runners (`self-hosted-fast`, warm
-# build directories via scripts/ci/warm-target.sh). Fork PRs' Linux jobs run on the isolated, ephemeral
-# `self-hosted-untrusted` runners (no warm caches) when the PR number ends in 7, 8 or 9 (the rest of
-# the fork PRs, and everything else, run on GitHub's runners, which have far more free slots).
-# The test archive is always built on GitHub's runners: the self-hosted machine has a newer
-# glibc, so its binaries wouldn't start on ubuntu-24.04, while the archive runs there unchanged
-# (same /home/runner/work checkout path). Fork pull requests, the nightly run and Run workflow
-# use GitHub's runners only; the self-hosted runners refuse any other job.
+# Every Linux job runs on Blacksmith's Ubuntu 24.04 runners (blacksmith-<N>vcpu-ubuntu-2404), sized
+# per job: 32 vCPU for the tests, 16 for Clippy, the archive build (nightly) and the merge queue's, 8 for compiles, doc and reference tests, 4 for the light checks, 2 for Select checks and ci.
+# The Windows shader job runs on Blacksmith's Windows Server 2025 runners (blacksmith-8vcpu-windows-2025);
+# the Windows app startup smoke stays on windows-latest, which has a desktop session that presents frames.
+# Pull requests, forks included, the merge queue, pushes to main and the nightly run all use them:
+# the runners are ephemeral, fork runs get no secrets, and main saves the build caches that every
+# other run restores read-only. Nightly and by hand, Build tests also makes an archive the matrix
+# jobs run; Blacksmith's image matches ubuntu-24.04, so the archive and the recorded goldens behave the
+# same.
 name: CI
 
 on:
   # Draft pull requests run no CI (see `changes`, `checks` and `ci`): it starts when the PR is
-  # marked ready for review, and on every push after that.
+  # marked ready for review, and on every push after that. `labeled` is there for approved-for-ci
+  # only (other labels are skipped, see the top of this file).
   pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
+    types: [opened, synchronize, reopened, ready_for_review, labeled]
   # The merge queue: each queued group runs the full suite before it lands on main.
   merge_group:
   push:
@@ -53,7 +65,10 @@ permissions:
 concurrency:
   # A new PR push replaces the old run. Only one run per group may wait, so a busy main would
   # cancel the waiting nightly (or a Run workflow) before it starts: they get groups of their own.
-  group: ci-${{ github.event_name }}-${{ github.ref }}
+  # A `labeled` event for any label but approved-for-ci does no work and must not cancel (or queue
+  # behind) the PR's real run, so it gets a group of its own; approved-for-ci replaces the
+  # unlabelled run with the full one.
+  group: ci-${{ github.event_name }}-${{ github.ref }}${{ github.event.action == 'labeled' && github.event.label.name != 'approved-for-ci' && format('-ignored-{0}', github.run_id) || '' }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
@@ -63,7 +78,7 @@ jobs:
   dependency-advisories:
     name: Dependency advisories
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -75,10 +90,10 @@ jobs:
 
   changes:
     name: Select checks
-    # Not on a draft: every other check needs this one, so they skip too.
-    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
-    # Trusted runs (see the top of this file) use the self-hosted runners.
-    runs-on: ${{ (github.event_name == 'merge_group' || (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)) && 'self-hosted-light' || 'ubuntu-24.04' }}
+    # Not on a draft: every other check needs this one, so they skip too. Not on a label other than
+    # approved-for-ci either (the same skip, for the same reason).
+    if: (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event.action != 'labeled' || github.event.label.name == 'approved-for-ci')
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     permissions:
       contents: read
       # To ask whether the merge queue already tested a commit pushed to main.
@@ -89,12 +104,13 @@ jobs:
       goldens: ${{ steps.paths.outputs.goldens }}
       windows: ${{ steps.paths.outputs.windows }}
       full: ${{ steps.paths.outputs.full }}
+      # Code changed on a pull request that has no approved-for-ci label yet: only Quick compile.
+      quick: ${{ steps.paths.outputs.quick }}
       packages: ${{ steps.paths.outputs.packages }}
       oracle: ${{ steps.paths.outputs.oracle }}
-      # Whether the other Linux jobs use the self-hosted runners too.
-      # Trusted self-hosted runs only: a fork PR's checks run on the untrusted pool and must never
-      # route the jobs after them to the trusted runners.
-      local: ${{ runner.environment == 'self-hosted' && !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) }}
+      doctests: ${{ steps.paths.outputs.doctests }}
+      # The passing run a merge of main carries forward (its URL), when this push is only that.
+      carried: ${{ steps.paths.outputs.carried }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -106,7 +122,11 @@ jobs:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
           PUSH_SHA: ${{ github.sha }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
           REPO: ${{ github.repository }}
+          APPROVED: ${{ contains(github.event.pull_request.labels.*.name, 'approved-for-ci') }}
           GH_TOKEN: ${{ github.token }}
         run: |
           native=false
@@ -115,17 +135,38 @@ jobs:
           windows=false
           full=true
           packages=
+          # Whether the NUL-separated paths in $1 reach any code: scripts/ci/affected.py selects
+          # something or the whole workspace. Documentation, packaging, other workflows and the bots'
+          # scripts select nothing. Pull requests and pushes to main share it.
+          select_packages() {
+            python3 -I scripts/ci/affected.py --paths "$1" > "$RUNNER_TEMP/ci-affected"
+            cat "$RUNNER_TEMP/ci-affected"
+            full=$(sed -n 's/^full=//p' "$RUNNER_TEMP/ci-affected")
+            packages=$(sed -n 's/^packages=//p' "$RUNNER_TEMP/ci-affected")
+          }
           if [ "$EVENT_NAME" = push ]; then
             # The queue lands the very commit its merge_group run tested. If that run passed,
             # testing the push again proves nothing new; otherwise (a merge that skipped the
             # queue, or the API cannot answer) test everything.
-            # curl and grep only: Select checks of a push runs on the self-hosted runner.
+            # The API through curl and grep, which every runner image has.
             tested=$(curl -fsS -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
               "https://api.github.com/repos/$REPO/actions/workflows/ci.yml/runs?event=merge_group&head_sha=$PUSH_SHA&status=success&per_page=1" \
               | grep -o '"total_count": *[0-9]*' | grep -o '[0-9]*$' || echo 0)
             if [ "${tested:-0}" -gt 0 ]; then
               echo "The merge queue already tested $PUSH_SHA: repository checks only."
+            elif tested=$(curl -fsS -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+                "https://api.github.com/repos/$REPO/actions/workflows/ci.yml/runs?event=push&branch=main&status=success&per_page=1" \
+                | grep -o '"head_sha": *"[0-9a-f]*"' | head -n 1 | grep -o '[0-9a-f]\{40\}') \
+              && [ -n "$tested" ] && git merge-base --is-ancestor "$tested" "$PUSH_SHA" \
+              && git diff --no-renames --name-only -z "$tested" "$PUSH_SHA" > "$RUNNER_TEMP/ci-paths" \
+              && select_packages "$RUNNER_TEMP/ci-paths" && [ "$full" != true ] && [ -z "$packages" ]; then
+              # Nothing a build reads changed since the last push to main whose run passed (the
+              # push before may never have run: a newer push cancels a waiting one).
+              echo "$tested..$PUSH_SHA changes no code: repository checks only."
             else
+              # Code changed (or the push can't be compared): main runs everything.
+              full=true
+              packages=
               native=true
               windows=true
             fi
@@ -137,9 +178,12 @@ jobs:
             git diff --no-renames --name-only -z "$BASE_SHA...$HEAD_SHA" > "$RUNNER_TEMP/ci-paths"
             while IFS= read -r -d '' path; do
               case "$path" in crates/kernel/*|vendor/truck-*) kernel=true ;; esac
-              # What can change a robustness golden: the kernel and the crates a design is built with.
+              # What a pull request re-checks the goldens for: the kernel, truck and the goldens
+              # themselves (a re-record is checked before it is queued). The goldens are frozen, so
+              # on any other change they would only re-check unchanged results; the merge queue,
+              # main and the nightly run every seed before anything lands.
               case "$path" in
-                crates/kernel/*|crates/engine/*|crates/doc/*|crates/sketch/*|crates/geom/*|vendor/truck-*) goldens=true ;;
+                crates/kernel/*|vendor/truck-*|tests/robustness/*) goldens=true ;;
               esac
               # What the Windows D3D12 jobs exercise: the GPU crate and its shaders, the app and
               # its startup, the viewport's wgpu glue, the vendored egui-wgpu, their scripts.
@@ -147,14 +191,6 @@ jobs:
                 crates/gpu/*|apps/solidcraft/*|crates/ui-egui/src/gpu.rs|vendor/egui-wgpu/*) windows=true ;;
                 tools/windows-*.ps1|.github/workflows/ci.yml|rust-toolchain*|.cargo/*) windows=true ;;
               esac
-              case "$path" in
-                .github/workflows/ci.yml) native=true ;;
-                *.rs|Cargo.toml|Cargo.lock|*/Cargo.toml|.cargo/*|rust-toolchain*) native=true ;;
-                docs/*|*.md|.github/*|packaging/*|LICENSE*|NOTICE|THIRD-PARTY-LICENSES.txt) ;;
-                # The GitHub bots' scripts: no Rust, tested in this job (Claim and triage bot tests).
-                scripts/claim/*|scripts/triage/*) ;;
-                *) native=true ;;
-              esac
             done < "$RUNNER_TEMP/ci-paths"
             # A lockfile change that moves the graphics stack (wgpu, naga, egui, winit, windows).
             if [ "$windows" = false ] && grep -qxz 'Cargo.lock' "$RUNNER_TEMP/ci-paths" \
@@ -162,13 +198,10 @@ jobs:
                 | grep -Eq '^[ +-]name = "(wgpu[a-z_-]*|naga|egui[a-z_-]*|eframe|winit|windows[a-z_-]*|d3d12)"'; then
               windows=true
             fi
-            # Pull requests build and test the touched packages and their dependents.
-            python3 -I scripts/ci/affected.py --paths "$RUNNER_TEMP/ci-paths" > "$RUNNER_TEMP/ci-affected"
-            cat "$RUNNER_TEMP/ci-affected"
-            full=$(sed -n 's/^full=//p' "$RUNNER_TEMP/ci-affected")
-            packages=$(sed -n 's/^packages=//p' "$RUNNER_TEMP/ci-affected")
-            # Code changed but nothing was selected: be safe and test everything.
-            if [ "$native" = true ] && [ "$full" != true ] && [ -z "$packages" ]; then full=true; fi
+            # Pull requests build and test the touched packages and their dependents; nothing
+            # selected means no code changed.
+            select_packages "$RUNNER_TEMP/ci-paths"
+            if [ "$full" = true ] || [ -n "$packages" ]; then native=true; fi
             # The goldens are solidcraft-engine tests: its tests must be in the archive.
             if [ "$goldens" = true ] && [ "$full" != true ]; then
               case " $packages " in *" solidcraft-engine "*) ;; *) packages="$packages solidcraft-engine" ;; esac
@@ -180,36 +213,60 @@ jobs:
           if [ "$EVENT_NAME" = pull_request ] && [ "$full" != true ]; then
             case " $packages " in *" solidcraft-cli "*) ;; *) oracle=false ;; esac
           fi
-          # The pull request fast lane: Windows and the reference tests run on main (and the nightly),
-          # not on every pull request push; a break there is fixed forward on main.
-          if [ "$EVENT_NAME" = pull_request ]; then windows=false; oracle=false; fi
+          # The pull request fast lane: Windows, the reference tests and the doc tests run on main
+          # (and the nightly), not on every pull request push; a break there is fixed forward on
+          # main. Over three days of pull requests the doc tests were the only failing job 3 times
+          # in about 7,900 runner-minutes, and the reference tests never were.
+          doctests=$native
+          if [ "$EVENT_NAME" = pull_request ]; then windows=false; oracle=false; doctests=false; fi
+          # Until a maintainer adds approved-for-ci, a pull request gets a quick compile instead of
+          # Clippy, the tests, the doc tests and the goldens.
+          quick=false
+          if [ "$EVENT_NAME" = pull_request ] && [ "$APPROVED" != true ]; then
+            quick=$native
+            native=false
+            oracle=false
+            goldens=false
+          fi
+          # A push that only merges main into the change (Merge branch 'main', Update branch) when
+          # the change itself already passed: nothing new to test here, and main tests the merged
+          # result after it lands. Over three days, 872 of 1,241 such merges brought in nothing that
+          # touched the pull request's files, and each restarted the whole run.
+          carried=
+          if [ "$EVENT_NAME" = pull_request ] && [ "$native" = true ]; then
+            carried=$(python3 -I scripts/ci/main_merge.py --base "$BASE_SHA" --head "$HEAD_SHA" --repo "$REPO" \
+              --pr "$PR_NUMBER" --head-repo "$HEAD_REPO" --head-ref "$HEAD_REF" | sed -n 's/^carried=//p')
+            if [ -n "$carried" ]; then
+              echo "Only a merge of main into a change that passed in $carried: repository checks only."
+              native=false
+              goldens=false
+            fi
+          fi
           {
             echo "native=$native"
             echo "kernel=$kernel"
             echo "goldens=$goldens"
             echo "windows=$windows"
             echo "oracle=$oracle"
+            echo "doctests=$doctests"
+            echo "carried=$carried"
             echo "full=$full"
+            echo "quick=$quick"
             echo "packages=$packages"
           } >> "$GITHUB_OUTPUT"
 
   checks:
     name: Format and repository checks
-    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
-    runs-on: ${{ (github.event_name == 'merge_group' || (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)) && 'self-hosted-fast' || 'ubuntu-24.04' }}
+    if: (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event.action != 'labeled' || github.event.label.name == 'approved-for-ci')
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Warm build directory (self-hosted runner)
-        if: runner.environment == 'self-hosted' && !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
-        run: scripts/ci/warm-target.sh checks
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt
-      # The trusted self-hosted runners keep their build directory and Cargo home instead; the
-      # untrusted ones (fork pull requests) start empty and restore main's cache, read-only.
-      - if: runner.environment == 'github-hosted' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      # Main saves the cache; every other run restores it, read-only.
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: repo-checks
           save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -223,6 +280,10 @@ jobs:
         run: cargo xtask licences --check
       - name: Dependency layers
         run: cargo xtask layers
+      - name: Universal UI containers
+        run: |
+          cargo xtask ui-containers
+          cargo test -p xtask ui_containers --locked
       - name: Sorted lists
         run: cargo xtask lists
       - name: Design format pending changes
@@ -231,27 +292,43 @@ jobs:
         run: cargo xtask web-offline-test
       - name: Affected-package selection self-test
         run: python3 -I scripts/ci/test_affected.py
-      - name: Claim and triage bot tests
-        run: node --test scripts/claim/*.test.js scripts/triage/*.test.js
+      - name: Merge-of-main detection self-test
+        run: python3 -I scripts/ci/test_main_merge.py
+      - name: Claim, triage and kernel-paused bot tests
+        run: node --test scripts/claim/*.test.js scripts/triage/*.test.js scripts/kernel-paused/*.test.js scripts/pr-checks/*.test.js
+
+  # Fast feedback for a pull request that has not been approved for the full CI yet.
+  quick-compile:
+    name: Quick compile
+    needs: changes
+    if: needs.changes.outputs.quick == 'true'
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Size parallel compiles to the job's memory
+        run: scripts/ci/build-jobs.sh
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: quick-compile
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+      - name: Cargo check
+        run: cargo check --workspace --all-targets --locked
 
   clippy:
     name: Native Linux Clippy
     needs: changes
     if: needs.changes.outputs.native == 'true'
-    runs-on: ${{ needs.changes.outputs.local == 'true' && 'self-hosted-fast' || 'ubuntu-24.04' }}
+    runs-on: blacksmith-16vcpu-ubuntu-2404
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Warm build directory (self-hosted runner)
-        if: runner.environment == 'self-hosted' && !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
-        run: scripts/ci/warm-target.sh clippy
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy
-      # The trusted self-hosted runners keep their build directory and Cargo home instead; the
-      # untrusted ones (fork pull requests) start empty and restore main's cache, read-only.
-      - if: runner.environment == 'github-hosted' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      # Main saves the cache; every other run restores it, read-only.
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: native-clippy
           save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -267,21 +344,33 @@ jobs:
 
   build-tests:
     name: Build tests
+    # The archive is for the action matrix and the property tests, which run only nightly and by
+    # hand. Pull requests, the merge queue and main build and run their tests in the `tests` job.
     needs: changes
-    if: needs.changes.outputs.native == 'true'
-    runs-on: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && (endsWith(format('{0}', github.event.pull_request.number), '7') || endsWith(format('{0}', github.event.pull_request.number), '8') || endsWith(format('{0}', github.event.pull_request.number), '9'))) && 'self-hosted-untrusted' || 'ubuntu-24.04' }}
-    # Fork builds compile inside gVisor on shared boxes; give them room to finish and upload.
-    timeout-minutes: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && (endsWith(format('{0}', github.event.pull_request.number), '7') || endsWith(format('{0}', github.event.pull_request.number), '8') || endsWith(format('{0}', github.event.pull_request.number), '9'))) && 90 || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) && 60 || 45 }}
+    if: ${{ !cancelled() && needs.changes.result == 'success' && needs.changes.outputs.native == 'true' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') }}
+    runs-on: blacksmith-16vcpu-ubuntu-2404
+    # Fork builds start from main's cache, read-only; give them room to finish and upload.
+    timeout-minutes: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) && 60 || 45 }}
     env:
       CARGO_INCREMENTAL: "0"
       RUSTC_WRAPPER: sccache
-      SCCACHE_GHA_ENABLED: "true"
-      SCCACHE_IGNORE_SERVER_IO_ERROR: "1"
+      SCCACHE_DIR: /home/runner/.cache/sccache
+      SCCACHE_CACHE_SIZE: 20G
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Size parallel compiles to the job's memory
         run: scripts/ci/build-jobs.sh
       - uses: dtolnay/rust-toolchain@stable
+      # sccache lives on a Blacksmith sticky disk (an ext4 volume cloned from the last snapshot,
+      # no 10 GB limit and no download). Only main commits it; pull requests, the merge queue and
+      # forks mount a clone and never write back, so nothing they build can reach main's cache.
+      - name: Mount the compiler cache
+        uses: useblacksmith/stickydisk@3f6be1451e3cad893b778bc93495c80452a5da26 # v1.7.2
+        continue-on-error: true
+        with:
+          key: ${{ github.repository }}-sccache-archive
+          path: /home/runner/.cache/sccache
+          commit: ${{ github.ref == 'refs/heads/main' && 'on-change' || 'false' }}
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: native-tests
@@ -313,73 +402,110 @@ jobs:
         run: sccache --show-stats
 
   tests:
-    name: Native Linux tests (${{ matrix.shard }}/4)
-    needs: [changes, build-tests]
-    runs-on: ${{ needs.changes.outputs.local == 'true' && 'self-hosted-fast' || ((github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && (endsWith(format('{0}', github.event.pull_request.number), '7') || endsWith(format('{0}', github.event.pull_request.number), '8') || endsWith(format('{0}', github.event.pull_request.number), '9'))) && 'self-hosted-untrusted' || 'ubuntu-24.04') }}
+    name: Native Linux tests
+    needs: changes
+    if: ${{ !cancelled() && needs.changes.result == 'success' && needs.changes.outputs.native == 'true' }}
+    # Builds the tests and runs them in one job on a big runner: there is no archive to upload
+    # and download (3 GB on a full run), and the job starts beside the repository checks, not
+    # after them. nextest hands tests to its threads as they free up, the slowest first (priority
+    # in .config/nextest.toml), so they start at once and no core idles at the end.
+    runs-on: blacksmith-32vcpu-ubuntu-2404
     timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        # Pull requests test their affected crates in 2 shards; main and the nightly use 4.
-        shard: ${{ fromJSON(github.event_name == 'pull_request' && '[1, 2]' || '[1, 2, 3, 4]') }}
     env:
       # Pictures (snapshots, screenshots, ui.render, the viewport's offscreen tests) are drawn on
       # the GPU. The runner has none: Mesa's lavapipe (software Vulkan) draws them, and a test that
       # would skip for want of an adapter fails instead.
       SOLIDCRAFT_GPU: software
       SOLIDCRAFT_REQUIRE_GPU: "1"
+      ACTION_MATRIX_JOBS: "12"
+      CARGO_INCREMENTAL: "0"
+      RUSTC_WRAPPER: sccache
+      SCCACHE_DIR: /home/runner/.cache/sccache
+      SCCACHE_CACHE_SIZE: 20G
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install a software Vulkan driver (lavapipe)
-        # Preinstalled on the self-hosted runner, which has no sudo.
-        if: runner.environment == 'github-hosted'
         run: |
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends mesa-vulkan-drivers libvulkan1
+      - name: Size parallel compiles to the job's memory
+        run: scripts/ci/build-jobs.sh
+      - uses: dtolnay/rust-toolchain@stable
+      # sccache lives on a Blacksmith sticky disk (an ext4 volume cloned from the last snapshot,
+      # no 10 GB limit and no download). Only main commits it; pull requests, the merge queue and
+      # forks mount a clone and never write back, so nothing they build can reach main's cache.
+      - name: Mount the compiler cache
+        uses: useblacksmith/stickydisk@3f6be1451e3cad893b778bc93495c80452a5da26 # v1.7.2
+        continue-on-error: true
+        with:
+          key: ${{ github.repository }}-sccache-tests
+          path: /home/runner/.cache/sccache
+          commit: ${{ github.ref == 'refs/heads/main' && 'on-change' || 'false' }}
+      # Main saves the cache; every other run restores it, read-only.
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: native-tests
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+      - name: Set up compiler cache
+        uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
+        with:
+          version: v0.16.0
       - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
         with:
           tool: cargo-nextest
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
-        with:
-          name: nextest-archive
       - name: Run tests
         env:
           EVENT_NAME: ${{ github.event_name }}
-          SHARD: ${{ matrix.shard }}
-          SHARDS: ${{ github.event_name == 'pull_request' && 2 || 4 }}
+          GOLDENS: ${{ needs.changes.outputs.goldens }}
+          FULL: ${{ needs.changes.outputs.full }}
+          PACKAGES: ${{ needs.changes.outputs.packages }}
+          # The robustness golden seeds a pull request skips: each takes one to twenty minutes under
+          # CI load, together about four fifths of the goldens' time. Pushes to main, the merge
+          # queue and the nightly run every seed.
+          SLOW_SEEDS: 81|45|20|24|95|02|57|40|18|48|32|46|85|61|77|34|14
         run: |
-          # Pull requests skip the heavy tests (default-filter in .config/nextest.toml).
-          all=()
-          # The boolean property tests draw new random inputs every run; they run only in the
-          # nightly property-tests job, so a known kernel bug cannot turn main red at random.
-          if [ "$EVENT_NAME" != pull_request ]; then
-            all=(--ignore-default-filter -E 'not (package(solidcraft-kernel) & binary(boolean_props))')
+          # Pull requests skip the heavy tests (default-filter in .config/nextest.toml); `default()`
+          # below is that filter, so a pull request still runs only what it ran before.
+          base='default()'
+          if [ "$EVENT_NAME" = pull_request ]; then
+            # The action matrix sample (about 6 minutes on all cores) runs in the merge queue, on
+            # main and nightly, not on every pull request push.
+            base='default() & not (binary(action_matrix) & test(=action_matrix_sample))'
           fi
-          # Extract into ./target: tests that run a built binary (env!("CARGO_BIN_EXE_*")) have
-          # the build job's path, which is the same checkout path here.
-          cargo nextest run --archive-file tests.tar.zst --workspace-remap . --extract-to . --extract-overwrite \
-            --profile ci --partition "slice:$SHARD/$SHARDS" --no-tests=pass "${all[@]}"
-      - name: Robustness goldens (pull requests that change geometry)
-        # Every seed of tests/robustness/goldens.json (each seed is a test), split over the shards;
-        # pushes to main and the nightly run them in the step above.
-        if: github.event_name == 'pull_request' && needs.changes.outputs.goldens == 'true'
-        env:
-          SHARD: ${{ matrix.shard }}
-          SHARDS: ${{ github.event_name == 'pull_request' && 2 || 4 }}
-        run: |
-          if ! cargo nextest run --archive-file tests.tar.zst --workspace-remap . --extract-to . --extract-overwrite \
-            --profile ci --ignore-default-filter --partition "slice:$SHARD/$SHARDS" --no-tests=pass \
-            -E 'package(solidcraft-engine) & test(/^tests::robustness_goldens::/)'; then
-            echo "::error::A robustness golden changed. If the new result is intended, re-record it in this pull request and say why:"
-            echo "::error::ROBUSTNESS_GOLDENS_BLESS=\"why it changed\" cargo test --profile ci -p solidcraft-engine --lib robustness_goldens::   (see docs/robustness.md)"
+          if [ "$EVENT_NAME" != pull_request ]; then
+            # The boolean property tests draw new random inputs every run; they run only in the
+            # nightly property-tests job, so a known kernel bug cannot turn main red at random.
+            base='not (package(solidcraft-kernel) & binary(boolean_props))'
+          elif [ "$GOLDENS" = true ]; then
+            # A pull request that can change a robustness golden (tests/robustness/goldens.json)
+            # also checks every seed but the slow ones, in the same run so they share its cores.
+            base="(default() & not (binary(action_matrix) & test(=action_matrix_sample))) | (package(solidcraft-engine) & test(/^tests::robustness_goldens::/) & not test(/^tests::robustness_goldens::seed_($SLOW_SEEDS)\$/))"
+          fi
+          junit=${CARGO_TARGET_DIR:-target}/nextest/ci/junit.xml
+          rm -f "$junit"
+          # Pull requests test the affected packages (scripts/ci/affected.py).
+          scope=(--workspace)
+          if [ "$FULL" != true ]; then scope=(); for p in $PACKAGES; do scope+=(-p "$p"); done; fi
+          status=0
+          cargo nextest run "${scope[@]}" --cargo-profile ci --locked --profile ci --no-tests=pass \
+            --ignore-default-filter -E "$base" || status=1
+          if [ "$status" != 0 ]; then
+            # A failed golden gets the hint to re-record it (junit.xml lists the failures).
+            if [ -f "$junit" ] && tr '\n' ' ' < "$junit" | grep -q '<testcase name="tests::robustness_goldens::[^"]*"[^>]*>[[:space:]]*<failure'; then
+              echo "::error::A robustness golden changed. If the new result is intended, re-record it in this pull request and say why:"
+              echo "::error::ROBUSTNESS_GOLDENS_BLESS=\"why it changed\" cargo test --profile ci -p solidcraft-engine --lib robustness_goldens::   (see docs/robustness.md)"
+            fi
             exit 1
           fi
+      - name: Compiler cache statistics
+        if: always()
+        run: sccache --show-stats
       - name: Upload test timings
         if: always()
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
-          name: junit-${{ matrix.shard }}
-          path: target/nextest/ci/junit.xml
+          name: junit
+          path: ${{ env.CARGO_TARGET_DIR || 'target' }}/nextest/ci/junit.xml
           retention-days: 7
 
   action-matrix:
@@ -390,7 +516,7 @@ jobs:
     name: Action matrix (${{ matrix.shard }}/16)
     needs: build-tests
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 55
     strategy:
       fail-fast: false
@@ -432,7 +558,7 @@ jobs:
     name: Action matrix determinism
     needs: build-tests
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -454,7 +580,7 @@ jobs:
     name: Property tests (many cases)
     needs: build-tests
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -477,26 +603,31 @@ jobs:
   doc-tests:
     name: Doc tests
     needs: changes
-    if: needs.changes.outputs.native == 'true'
-    runs-on: ${{ needs.changes.outputs.local == 'true' && 'self-hosted-fast' || 'ubuntu-24.04' }}
+    if: needs.changes.outputs.doctests == 'true'
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 45
     env:
       CARGO_INCREMENTAL: "0"
       RUSTC_WRAPPER: sccache
-      SCCACHE_GHA_ENABLED: "true"
-      SCCACHE_IGNORE_SERVER_IO_ERROR: "1"
+      SCCACHE_DIR: /home/runner/.cache/sccache
+      SCCACHE_CACHE_SIZE: 20G
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Size parallel compiles to the job's memory
         run: scripts/ci/build-jobs.sh
-      - name: Warm build directory (self-hosted runner)
-        if: runner.environment == 'self-hosted' && !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
-        run: scripts/ci/warm-target.sh doc-tests
       - uses: dtolnay/rust-toolchain@stable
-      # The trusted self-hosted runners keep their build directory and Cargo home instead; the
-      # untrusted ones (fork pull requests) start empty and restore main's cache, read-only.
-      - if: runner.environment == 'github-hosted' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      # sccache lives on a Blacksmith sticky disk (an ext4 volume cloned from the last snapshot,
+      # no 10 GB limit and no download). Only main commits it; pull requests, the merge queue and
+      # forks mount a clone and never write back, so nothing they build can reach main's cache.
+      - name: Mount the compiler cache
+        uses: useblacksmith/stickydisk@3f6be1451e3cad893b778bc93495c80452a5da26 # v1.7.2
+        continue-on-error: true
+        with:
+          key: ${{ github.repository }}-sccache-doc
+          path: /home/runner/.cache/sccache
+          commit: ${{ github.ref == 'refs/heads/main' && 'on-change' || 'false' }}
+      # Main saves the cache; every other run restores it, read-only.
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: doc-tests
           save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -531,25 +662,30 @@ jobs:
     name: Reference tests
     needs: changes
     if: needs.changes.outputs.oracle == 'true'
-    runs-on: ${{ needs.changes.outputs.local == 'true' && 'self-hosted-fast' || ((github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && (endsWith(format('{0}', github.event.pull_request.number), '7') || endsWith(format('{0}', github.event.pull_request.number), '8') || endsWith(format('{0}', github.event.pull_request.number), '9'))) && 'self-hosted-untrusted' || 'ubuntu-24.04') }}
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 60
     env:
       CARGO_INCREMENTAL: "0"
       RUSTC_WRAPPER: sccache
-      SCCACHE_GHA_ENABLED: "true"
-      SCCACHE_IGNORE_SERVER_IO_ERROR: "1"
+      SCCACHE_DIR: /home/runner/.cache/sccache
+      SCCACHE_CACHE_SIZE: 20G
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Size parallel compiles to the job's memory
         run: scripts/ci/build-jobs.sh
-      - name: Warm build directory (self-hosted runner)
-        if: runner.environment == 'self-hosted' && !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
-        run: scripts/ci/warm-target.sh oracle
       - uses: dtolnay/rust-toolchain@stable
-      # The trusted self-hosted runners keep their build directory and Cargo home instead; the
-      # untrusted ones (fork pull requests) start empty and restore main's cache, read-only.
-      - if: runner.environment == 'github-hosted' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      # sccache lives on a Blacksmith sticky disk (an ext4 volume cloned from the last snapshot,
+      # no 10 GB limit and no download). Only main commits it; pull requests, the merge queue and
+      # forks mount a clone and never write back, so nothing they build can reach main's cache.
+      - name: Mount the compiler cache
+        uses: useblacksmith/stickydisk@3f6be1451e3cad893b778bc93495c80452a5da26 # v1.7.2
+        continue-on-error: true
+        with:
+          key: ${{ github.repository }}-sccache-oracle
+          path: /home/runner/.cache/sccache
+          commit: ${{ github.ref == 'refs/heads/main' && 'on-change' || 'false' }}
+      # Main saves the cache; every other run restores it, read-only.
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: oracle
           save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -577,7 +713,7 @@ jobs:
     name: Windows D3D12 FXC shaders
     needs: changes
     if: needs.changes.outputs.windows == 'true'
-    runs-on: windows-latest
+    runs-on: blacksmith-8vcpu-windows-2025
     timeout-minutes: 45
     env:
       WGPU_BACKEND: dx12
@@ -605,6 +741,8 @@ jobs:
     name: Windows app startup
     needs: changes
     if: needs.changes.outputs.windows == 'true'
+    # GitHub-hosted: the startup smoke needs an interactive desktop that presents frames; on
+    # Blacksmith's Windows runners the window never presents ("no frame was presented").
     runs-on: windows-latest
     timeout-minutes: 60
     steps:
@@ -627,19 +765,57 @@ jobs:
 
   # Preserve the existing check name for branch protection, including docs-only PRs.
   ci:
-    needs: [changes, checks, clippy, build-tests, tests, doc-tests, oracle, windows-fxc, windows-startup]
+    # On a run another label starts (every other job skipped), this job reports the result of the
+    # commit's real run instead: the merge queue reads `ci` from the newest run of a commit, so a
+    # run without a passing `ci` would block a pull request that passed (#1850, #3182, #3252).
+    name: ci
+    needs: [changes, checks, quick-compile, clippy, build-tests, tests, doc-tests, oracle, windows-fxc, windows-startup]
     if: always() && (github.event_name != 'pull_request' || !github.event.pull_request.draft)
-    runs-on: ${{ needs.changes.outputs.local == 'true' && 'self-hosted-light' || 'ubuntu-24.04' }}
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    permissions:
+      contents: read
+      # To read the commit's other runs of this workflow.
+      actions: read
     steps:
+      - name: Report the commit's real result (a run another label started)
+        if: github.event.action == 'labeled' && github.event.label.name != 'approved-for-ci'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          SHA: ${{ github.event.pull_request.head.sha }}
+          RUN_ID: ${{ github.run_id }}
+        run: |
+          # The other runs of ci.yml for this commit. While one is still going, wait for it (at
+          # most 90 minutes); then pass only when the newest one that ran its checks passed.
+          deadline=$((SECONDS + 5400))
+          while :; do
+            runs=$(gh api "repos/$REPO/actions/workflows/ci.yml/runs?head_sha=$SHA&event=pull_request&per_page=100" \
+              --jq "[.workflow_runs[] | select(.id != $RUN_ID)]")
+            pending=$(jq '[.[] | select(.status != "completed")] | length' <<<"$runs")
+            if [ "$pending" -eq 0 ] || [ "$SECONDS" -ge "$deadline" ]; then break; fi
+            echo "Waiting for $pending run(s) of this commit to finish."
+            sleep 30
+          done
+          # Runs with every job skipped (labels, before this job reported) are not a result.
+          latest=$(jq -r '[.[] | select(.status == "completed" and .conclusion != "skipped")]
+            | sort_by(.created_at) | last | "\(.conclusion) \(.html_url)"' <<<"$runs")
+          echo "The commit's latest run: $latest"
+          echo "A label started this run: \`ci\` repeats the commit's latest result ($latest)." >> "$GITHUB_STEP_SUMMARY"
+          test "${latest%% *}" = success
       - name: Verify required checks
+        if: github.event.action != 'labeled' || github.event.label.name == 'approved-for-ci'
         env:
           CHANGES: ${{ needs.changes.result }}
           CHECKS: ${{ needs.checks.result }}
           NATIVE: ${{ needs.changes.outputs.native }}
+          QUICK: ${{ needs.changes.outputs.quick }}
+          QUICK_COMPILE: ${{ needs.quick-compile.result }}
           WINDOWS: ${{ needs.changes.outputs.windows }}
           ORACLE_RUN: ${{ needs.changes.outputs.oracle }}
+          DOCTESTS: ${{ needs.changes.outputs.doctests }}
           CLIPPY: ${{ needs.clippy.result }}
           BUILD: ${{ needs.build-tests.result }}
+          EVENT_NAME: ${{ github.event_name }}
           TESTS: ${{ needs.tests.result }}
           DOCS: ${{ needs.doc-tests.result }}
           ORACLE: ${{ needs.oracle.result }}
@@ -648,10 +824,19 @@ jobs:
         run: |
           test "$CHANGES" = success
           test "$CHECKS" = success
+          # An unapproved pull request: the heavy jobs are skipped on purpose.
+          if [ "$QUICK" = true ]; then
+            test "$QUICK_COMPILE" = success
+          fi
           if [ "$NATIVE" = true ]; then
             test "$CLIPPY" = success
-            test "$BUILD" = success
+            # The archive for the action matrix and property tests exists nightly and by hand only.
+            if [ "$EVENT_NAME" = schedule ] || [ "$EVENT_NAME" = workflow_dispatch ]; then
+              test "$BUILD" = success
+            fi
             test "$TESTS" = success
+          fi
+          if [ "$DOCTESTS" = true ]; then
             test "$DOCS" = success
           fi
           if [ "$ORACLE_RUN" = true ]; then
@@ -661,11 +846,17 @@ jobs:
             test "$WINDOWS_FXC" = success
             test "$WINDOWS_STARTUP" = success
           fi
+      - name: Note a carried result
+        if: needs.changes.outputs.carried != ''
+        env:
+          CARRIED: ${{ needs.changes.outputs.carried }}
+        run: |
+          echo "This push only merges main into a change that already passed; the heavy checks were not repeated. Passing run: $CARRIED" >> "$GITHUB_STEP_SUMMARY"
 
   wasm:
     name: Compile WebAssembly (manual)
     if: github.event_name == 'workflow_dispatch' && inputs.cross_compile
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -681,7 +872,7 @@ jobs:
   riscv64-gates:
     name: Compile RISC-V (manual)
     if: github.event_name == 'workflow_dispatch' && inputs.cross_compile
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/claim.yml

@@ -27,9 +27,7 @@ concurrency:
 jobs:
   claim:
     name: Claim bot
-    # The bots run main's own scripts (never PR code), so the trusted light runner takes them
-    # and GitHub's shared runners stay free for pull request builds.
-    runs-on: self-hosted-light
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     if: >-
       github.event_name != 'issue_comment' ||

.github/workflows/docker.yml

@@ -14,6 +14,11 @@ name: Docker
 on:
   push:
     branches: [main]
+    # The image holds the web app only: documentation, test data and the GitHub bots' scripts can't
+    # change it, so a push touching only those builds nothing (edge stays at the last code change).
+    # ATTRIBUTION.md is the exception among the Markdown files: the app embeds it (Help, About).
+    # The last matching pattern wins.
+    paths: ["**", "!docs/**", "!**/*.md", "ATTRIBUTION.md", "!tests/**", "!scripts/claim/**", "!scripts/triage/**"]
   release:
     types: [published]
   pull_request:

.github/workflows/generated.yml

@@ -1,11 +1,27 @@
 # Files generated from the code are rewritten here, on main, after each merge, so pull requests
 # never edit them (two pull requests that each regenerated one would always conflict):
 # THIRD-PARTY-LICENSES.txt (`cargo xtask licences`) and docs/features.md (`cargo xtask features`).
+# Pending files (assets/locales/pending, attribution/pending) are folded into the catalogs and
+# ATTRIBUTION.md by `cargo xtask fold-pending`.
 name: Generated files
 
 on:
   push:
     branches: [main]
+    # THIRD-PARTY-LICENSES.txt follows the manifests, the lockfile, the vendored crates' licence
+    # files and the fonts' licences; docs/features.md follows the command registry (crates/engine),
+    # read through solidcraft-cli. Other pushes regenerate nothing.
+    paths:
+      - "Cargo.lock"
+      - "**/Cargo.toml"
+      - "vendor/**"
+      - "assets/fonts/**"
+      - "crates/engine/**"
+      - "apps/solidcraft-cli/**"
+      - "xtask/**"
+      - "assets/locales/pending/*.json"
+      - "attribution/pending/*.md"
+      - ".github/workflows/generated.yml"
   workflow_dispatch:
 
 permissions:
@@ -36,13 +52,15 @@ jobs:
         run: cargo xtask licences
       - name: docs/features.md
         run: cargo xtask features
+      - name: Pending locale strings and attribution rows
+        run: cargo xtask fold-pending
       - name: Commit if changed
         run: |
-          if git diff --quiet -- THIRD-PARTY-LICENSES.txt docs/features.md; then echo "unchanged"; exit 0; fi
+          if [ -z "$(git status --porcelain)" ]; then echo "unchanged"; exit 0; fi
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add THIRD-PARTY-LICENSES.txt docs/features.md
-          git commit -m "Regenerate THIRD-PARTY-LICENSES.txt and docs/features.md [skip ci]"
+          git add -A THIRD-PARTY-LICENSES.txt docs/features.md assets/locales ATTRIBUTION.md attribution
+          git commit -m "Regenerate generated files and fold pending files [skip ci]"
           for _ in 1 2 3; do
             git pull --rebase origin main && git push origin HEAD:main && exit 0
             sleep 10

.github/workflows/kernel-paused.yml

@@ -0,0 +1,42 @@
+# While a new geometry kernel is evaluated, new issues, pull requests and discussions about kernel
+# work are labelled `kernel-paused` for a maintainer to answer (CONTRIBUTING.md, "Kernel work is
+# paused"). The logic is in scripts/kernel-paused/ (tested in ci.yml).
+name: Kernel paused
+
+on:
+  issues:
+    types: [opened]
+  # pull_request_target so PRs from forks can be labelled. It runs the base branch's
+  # scripts/kernel-paused and only lists the PR's changed paths; the PR's code is never checked out.
+  pull_request_target:
+    types: [opened]
+  discussion:
+    types: [created]
+
+permissions:
+  contents: read # to check out scripts/kernel-paused
+  issues: write
+  pull-requests: read # to list a PR's changed paths
+  discussions: write
+
+concurrency:
+  group: kernel-paused-${{ github.event.issue.number || github.event.pull_request.number || github.event.discussion.number }}
+  cancel-in-progress: false
+
+jobs:
+  paused:
+    name: Kernel paused bot
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          sparse-checkout: scripts/kernel-paused
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const paused = require('./scripts/kernel-paused/kernel-paused.js');
+            const done = context.eventName === 'discussion'
+              ? await paused.handleDiscussion({ github, context })
+              : await paused.handleOpened({ github, context });
+            core.info(done);

.github/workflows/packaging-lint.yml

@@ -39,6 +39,8 @@ jobs:
         run: python3 packaging/tests/nightly_test.py
       - name: Windows executable icon validation regression
         run: python3 packaging/tests/windows_icon_test.py
+      - name: AppImage CLI wrapper regression
+        run: python3 packaging/tests/apprun_test.py
       - name: Flatpak desktop smoke validation regression
         run: python3 packaging/tests/flatpak_test.py
       - name: PowerShell

.github/workflows/pages.yml

@@ -6,6 +6,8 @@ name: Pages
 on:
   push:
     branches: [main]
+    # The site is the book and the web app: test data and the GitHub bots' scripts change neither.
+    paths-ignore: ["tests/**", "scripts/claim/**", "scripts/triage/**"]
   workflow_dispatch:
     inputs:
       release_tag:

.github/workflows/pr-checks.yml

@@ -0,0 +1,69 @@
+# Two quick checks on every pull request (CONTRIBUTING.md, "Sending a change"): no second open PR
+# for an issue a lower-numbered one already closes, and the "Changes a default:" line is filled in.
+# Neither is a required status check. The logic is in scripts/pr-checks/pr-checks.js (tested in ci.yml).
+name: PR checks
+
+on:
+  # pull_request, never pull_request_target: nothing here checks out or runs the PR's code, and the
+  # token is read-only for fork PRs. Only scripts/pr-checks from the PR's own merge commit is run.
+  pull_request:
+    types: [opened, edited, synchronize, reopened, ready_for_review, labeled, unlabeled]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+concurrency:
+  group: pr-checks-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  duplicate:
+    name: Duplicate PR check
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          sparse-checkout: scripts/pr-checks
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const checks = require('./scripts/pr-checks/pr-checks.js');
+            const r = await checks.checkDuplicate({ github, context, core });
+            core.info(JSON.stringify(r));
+
+  defaults:
+    name: Defaults line check
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          sparse-checkout: scripts/pr-checks
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const checks = require('./scripts/pr-checks/pr-checks.js');
+            const r = await checks.checkDefaults({ github, context, core });
+            core.info(JSON.stringify(r));
+
+  # Labelling needs write access, which a fork PR's token never has, so it is its own job and best
+  # effort: a fork PR just doesn't get the `changes-default` label from here.
+  label:
+    name: Label changes-default
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    continue-on-error: true
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          sparse-checkout: scripts/pr-checks
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const checks = require('./scripts/pr-checks/pr-checks.js');
+            await checks.syncDefaultLabel({ github, context, core });

.github/workflows/release.yml

@@ -4,11 +4,12 @@
 # comes from [workspace.package] in Cargo.toml. An agent verifies the artifacts and publishes
 # the draft separately; see docs/releasing.md. Tags and pushes to main do not trigger releases.
 # At midnight Eastern, changed main commits build and publish a nightly pre-release.
-# A version with a suffix (0.2.0-rc.1) is a pre-release. Nothing is signed yet.
+# A version with a suffix (0.2.0-rc.1) is a pre-release.
+# The macOS app is signed and notarized when the APPLE_* secrets exist, nothing else is signed yet.
 #
 #   Linux x86_64, aarch64   AppImage (+ .zsync), .deb, .rpm, .flatpak, .snap, .tar.gz packaging/linux
 #   FreeBSD x86_64          .tar.gz (built in a FreeBSD VM)                        packaging/freebsd
-#   macOS universal         .dmg, and the CLI as a .zip                            packaging/macos
+#   macOS universal         .dmg, and the CLI as a .zip (both archs built in parallel)  packaging/macos
 #   Windows x64, x86, arm64 .msi and a portable .zip; x64 also the plain .exe      packaging/windows
 #   Web                     a .zip of the static site                              packaging/web
 #
@@ -203,6 +204,8 @@ jobs:
     name: Snap ${{ matrix.arch }}
     needs: [version, linux]
     if: needs.version.outputs.build == 'true'
+    # The Snap Store hasn't accepted SolidCraft yet, so a snap failure never holds up a release.
+    continue-on-error: true
     # Repackages the Linux job's tarball, like the Flatpak. On 24.04 because the core24 base is
     # Ubuntu 24.04, which lets snapcraft build on the runner itself (--destructive-mode).
     runs-on: ${{ matrix.runner }}
@@ -293,11 +296,19 @@ jobs:
           path: dist/release/*
           if-no-files-found: error
 
-  macos:
-    name: macOS universal
+  # The two halves of the universal binary build in parallel on their own runners (each alone
+  # took about half of the old single job's 45 minutes); `macos` below joins and packages them.
+  macos-build:
+    name: macOS build ${{ matrix.arch }}
     needs: version
     if: needs.version.outputs.build == 'true'
     runs-on: macos-14
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { arch: aarch64, target: aarch64-apple-darwin }
+          - { arch: x86_64, target: x86_64-apple-darwin }
     env:
       SOLIDCRAFT_VERSION: ${{ needs.version.outputs.version }}
       SOLIDCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
@@ -305,12 +316,58 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: dtolnay/rust-toolchain@stable
         with:
-          targets: aarch64-apple-darwin, x86_64-apple-darwin
+          targets: ${{ matrix.target }}
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
-          key: release-macos-universal
-      - name: Build and package (dmg, CLI zip; the dmg is mounted and checked)
-        run: packaging/macos/package.sh --arch universal
+          key: release-macos-${{ matrix.arch }}
+      - name: Build
+        run: packaging/macos/package.sh --build-only ${{ matrix.target }}
+      # Not named release-*: the release job collects every release-* artifact as an asset.
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: macos-bin-${{ matrix.arch }}
+          path: |
+            target/${{ matrix.target }}/release/solidcraft
+            target/${{ matrix.target }}/release/solidcraft-cli
+            target/${{ matrix.target }}/release/solvecraft-cli
+          if-no-files-found: error
+
+  macos:
+    name: macOS universal
+    needs: [version, macos-build]
+    if: needs.version.outputs.build == 'true'
+    runs-on: macos-14
+    env:
+      SOLIDCRAFT_VERSION: ${{ needs.version.outputs.version }}
+      SOLIDCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: macos-bin-aarch64
+          path: target/aarch64-apple-darwin/release
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: macos-bin-x86_64
+          path: target/x86_64-apple-darwin/release
+      - name: Set up Developer ID signing and notarization
+        # Optional until the APPLE_* secrets exist (docs/releasing.md, "macOS signing"). Without
+        # them (forks, dry runs) the app keeps its ad-hoc signature and is not notarized.
+        env:
+          APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+        run: packaging/macos/signing.sh --setup
+      - name: Join, sign, package and check (dmg, CLI zip; the dmg is mounted and checked)
+        run: |
+          # Artifacts don't keep the executable bit.
+          chmod +x target/*-apple-darwin/release/solidcraft target/*-apple-darwin/release/solidcraft-cli target/*-apple-darwin/release/solvecraft-cli
+          packaging/macos/package.sh --arch universal --skip-build ${MACOS_SIGN_IDENTITY:+--sign}
+      - name: Remove the signing keychain and API key
+        if: always()
+        run: packaging/macos/signing.sh --cleanup
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-macos

.github/workflows/triage.yml

@@ -33,9 +33,7 @@ concurrency:
 jobs:
   triage:
     name: Triage bot
-    # The bots run main's own scripts (never PR code), so the trusted light runner takes them
-    # and GitHub's shared runners stay free for pull request builds.
-    runs-on: self-hosted-light
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
     # Filtered here so the common events (every comment, every label) start no runner.
     if: >-

.gitignore

@@ -7,3 +7,7 @@
 /.claude/worktrees/
 /target-snapshot
 __pycache__/
+.vscode/
+
+# cargo-mutants output (docs/mutation-testing.md)
+mutants.out*/

AGENTS.md

@@ -27,13 +27,18 @@ new uses of it anywhere else. Public docs/web/Flatpak deployments use project Pa
 ## Never crash
 People trust SolidCraft with their designs; a crash loses their work. **This outranks feature work.**
 - **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`,
-  `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`). The three exceptions, in the app crate
-  (which denies it instead), have no safe API: two functions in
+  `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`). The exceptions, in the app crate and in
+  `crates/threedx-client` (which deny it instead), have no safe API: the macOS-only
+  `crates/threedx-client/src/macos.rs` (loads the 3Dconnexion driver's client framework at run time
+  and calls through its function pointers), two functions in
   `apps/solidcraft/src/open_documents.rs` (macOS hands Finder files only to an Objective-C
   method), the Windows-only `apps/solidcraft/src/native_crash.rs` (the exception filter that
-  records crashes inside native code such as graphics drivers) and the Windows-only
+  records crashes inside native code such as graphics drivers), the Windows-only
   `apps/solidcraft/src/native_frame.rs` (the window procedure that answers the resize-border hit
-  test of the window without OS decorations).
+  test of the window without OS decorations, and gives its class the icon the taskbar falls back
+  on) and the Windows-only
+  `apps/solidcraft/src/space_mouse/windows_hid.rs` (asks Plug and Play which HID interfaces are 3D
+  mice, so no other device is sent anything).
 - **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature
   returns an error ("not supported yet: …"); it never panics.
 - **Input-derived numbers are hostile** (command parameters, design files, control-channel
@@ -48,6 +53,8 @@ People trust SolidCraft with their designs; a crash loses their work. **This out
   `crashes replay <id>` (or the `diagnostics.crash_reports` command / MCP `crash_reports` tool).
 - **Prove it:** every crash fix lands with a regression test (see `hostile_params_never_panic`); a
   crash report's `design.solidcraft` + `replay.json` is the test's starting point.
+- **Where tests go:** a regression test goes into the existing test file for its area (booleans, blends,
+  shell, sweep, STEP, naming…), never a new file named after the bug (#3226).
 - Every production crate root carries
   `#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]`.
 
@@ -84,6 +91,14 @@ People trust SolidCraft with their designs; a crash loses their work. **This out
   egui/eframe/winit/wgpu/rfd. **The UI crate is swappable.** Only `crates/kernel` may use `truck`.
 - **The UI is thin**: panels read engine state and act through `app.run(id, params)` /
   `app.start(id)`. Colours come from `theme::Tokens`.
+- **One outer UI container**: all panels, floating sheets, menus, overlays and platform UI
+  windows use `ui_kit::Container` (directly or through `Panel`, `Window`, `Confirm`, `Menu`).
+  Declare the semantic `Surface`; workspace panels use its shared layout policy and chrome.
+  System/report windows use `ui_kit::Window`; its low-level host builder is kit-private.
+  Do not construct raw egui hosts, outer popup/window frames or shadows in feature modules.
+  `cargo xtask ui-containers` recursively checks source/examples in all current and future crates
+  and apps. It runs in the fast repository CI job and `cargo xtask ci`, with no caller allowances.
+  See `docs/ui-container-audit.md` for the inventory and legitimate content/native exceptions.
 - **One set of camera controls**: every page or canvas with a camera (viewport, Render
   preview, future flat pattern or drawing pages) calls `navigation::handle` with its `NavCaps`
   (orbit off for flat 2D pages). New canvases must use `navigation::handle`; never hand-roll
@@ -96,12 +111,13 @@ People trust SolidCraft with their designs; a crash loses their work. **This out
   Keep them minimal; `cargo xtask web-offline-test` covers the service worker.
 - **Quality gates** before every commit: `cargo xtask ci` (fmt, clippy -D warnings, tests,
   assets, layers). Commit after every feature arc that builds.
-- **Publishing**: `origin` is github.com/bherbruck/solidcraft. Changes land through **pull requests**:
-  push a branch, open a PR, and let GitHub CI run. Maintainers (and agents working for them) may
-  merge their own PR as soon as CI is green (`gh pr merge --squash`); a trivial fix (docs, typos)
-  may be merged right away. Keep each PR to one topic, rebase or merge `main` into it when it
-  conflicts, and never force-push `main`. Never commit `plan/`, build dirs (`target*/`) or
-  generated reference data; check `git ls-files` before pushing.
+- **Publishing**: the repository is github.com/tangency-labs/solidcraft. Changes land through
+  **pull requests** and the **merge queue**: push a branch and open a PR. The heavy CI jobs start
+  when a maintainer adds `approved-for-ci` after reviewing the code. Approved PRs go into the queue
+  with `gh pr merge N -R tangency-labs/solidcraft --squash --auto`; the queue runs the full suite
+  on each group before it lands on `main`. Keep each PR to one topic and one issue, and never
+  force-push `main`. Never commit `plan/`, build dirs (`target*/`) or generated reference data;
+  check `git ls-files` before pushing.
 - **Never break wasm**: everything below the apps must build for `wasm32-unknown-unknown`
   (`cargo xtask wasm`, part of `cargo xtask ci`).
 
@@ -120,22 +136,37 @@ People trust SolidCraft with their designs; a crash loses their work. **This out
 - Use a small public-safe example and check for private designs, paths, account details or
   other sensitive content before sharing. Attach media to the issue/PR or link to an accessible
   recording; do not commit generated screenshots or videos just to provide review evidence.
-- Throughout the work and before handoff, check current upstream commits and the relevant
-  PR's merge status. Keep your branch current with upstream merges, resolve conflicts without
-  discarding others' work, and re-run validation when integration changes the result. Use
-  `git pull --rebase origin main` before pushing as above; never force-push. Report the checked
-  upstream/PR state, any conflicts resolved and the validation performed. If a PR remains open,
-  keep monitoring it while the task is active and make its pending status clear at handoff;
-  do not claim it merged without checking.
+- Throughout the work and before handoff, check the relevant PR's merge status. Don't push to
+  an open PR only to catch up with `main` (no merge of `main`, no Update branch, no rebase for
+  that alone): every push restarts the whole CI run, and `main`'s own run catches what lands in
+  between, to be fixed forward. When you push a change anyway, or GitHub reports a conflict,
+  rebase onto the latest `main` (push your own branch with `--force-with-lease`); never merge
+  `main` into a PR. Resolve conflicts without discarding others' work; never force-push `main`.
+  Don't re-run CI on an unchanged commit: a real failure fails again. Re-run only a job that
+  runner trouble cancelled, with "Re-run failed jobs". Report the PR state you checked and any
+  conflicts resolved. If a PR remains open, keep monitoring it while the task is active and
+  make its pending status clear at handoff; do not claim it merged without checking.
+
+## Before you start: look at what is already open
+- Work with an authenticated GitHub CLI (`gh auth status`) and `git`; the checks below need both.
+- Pull the whole list, not one search: `gh pr list -R tangency-labs/solidcraft --state open --limit 500`
+  (drafts included) and `gh issue list -R tangency-labs/solidcraft --state open --limit 500`. Look for
+  work on the same issue, the same feature under another number, and PRs that change the files
+  you are about to change (`gh pr list ... --json number,title,files`).
+- If someone already has it, comment on their PR or issue instead of opening a second one. Two
+  PRs for one change can't both land, and one of them is wasted work and CI.
+
+- Keep the `Changes a default:` line in the PR description filled in, and don't open a second PR for
+  an issue a lower-numbered open PR already closes; `pr-checks.yml` fails both (CONTRIBUTING.md, "Sending a change").
 
 ## Claim = a draft PR
-- Before working on issue #N, check nobody has it: `gh pr list -R bherbruck/solidcraft --state open --search "#N"`.
+- Before working on issue #N, check nobody has it: `gh pr list -R tangency-labs/solidcraft --state open --search "#N"`.
 - If none, branch from the latest `origin/main`, `git commit --allow-empty -m "claim: #N"`, push,
   and open a **draft** PR titled `<summary> (#N)` right away. **The lowest-numbered open PR for an
-  issue wins**; if yours lost, close it. A comment or file edit alone does not replace the draft PR.
-- After opening the draft PR, comment `/claim` on the issue so the bot records the claimant and
-  adds the `in progress` label. **Do both:** the draft PR establishes ownership and `/claim` marks
-  the issue as taken. Reference `#N` in the PR so the bot can find it.
+  issue wins**; if yours lost, close it. Opening the PR is the claim: the bot assigns you and
+  labels the issue `in progress` (or says on your PR who holds it). Reference `#N` in the PR title
+  so the bot can find it. Don't claim by editing files; comment `/claim` on the issue only to stake
+  a claim before you have a branch.
 - Push work in progress at least daily. A draft with no pushes for 72 hours may be taken over:
   comment on it first, then open your own claim (you may start from its branch).
   This takeover policy is separate from the bot's automatic cleanup deadlines in CONTRIBUTING.md.
@@ -187,3 +218,5 @@ workflow; never regenerate them in a PR.
 Keep them conflict-free (CONTRIBUTING.md, "Lists many changes add to"): message catalogs sorted
 (`cargo xtask lists --fix`), `mod` lines in their sorted group, the language list English first
 then by id, generated files left to `main`, and a design-format change as one new file.
+New UI strings go in a new `assets/locales/pending/<slug>.json` and new ATTRIBUTION.md rows in a new
+`attribution/pending/<slug>.md`, never into the catalogs or the table (see the README in each folder).

ATTRIBUTION.md

@@ -14,8 +14,33 @@ Editable drawing code, native projects and shipped exports are collected under `
 
 | File | Author | Source | Licence |
 |---|---|---|---|
+| assets/render/catalog/capabilities.json | SolidCraft contributors | Byte-identical runtime export of docs/render-materials/capabilities.json; generated and checked by tools/render-library/generate.py | MIT OR Apache-2.0 |
+| assets/render/catalog/environments.json | SolidCraft contributors | Byte-identical runtime export of docs/render-materials/environments.json; generated and checked by tools/render-library/generate.py | MIT OR Apache-2.0 |
+| assets/render/catalog/lighting.json | SolidCraft contributors | Byte-identical runtime export of docs/render-materials/lighting.json; generated and checked by tools/render-library/generate.py | MIT OR Apache-2.0 |
+| assets/render/catalog/materials.json | SolidCraft contributors | Byte-identical runtime export of docs/render-materials/materials.json; generated and checked by tools/render-library/generate.py | MIT OR Apache-2.0 |
+| assets/render/catalog/quality-presets.json | SolidCraft contributors | Byte-identical runtime export of docs/render-materials/quality-presets.json; generated and checked by tools/render-library/generate.py | MIT OR Apache-2.0 |
+| assets/render/catalog/scene-presets.json | SolidCraft contributors | Byte-identical runtime export of docs/render-materials/scene-presets.json; generated and checked by tools/render-library/generate.py | MIT OR Apache-2.0 |
+| examples/chebyshev-motion-trace.json | SolidCraft contributors | Original parametric Chebyshev lambda mechanism and associative-trace demo, constructed from analytic circle intersections; classical link proportions documented at https://doi.org/10.1002/rcs.70095; no external CAD geometry or artwork | MIT OR Apache-2.0 |
+| examples/material-card.json | SolidCraft contributors | original analytic box and explicitly synthetic engineering card; invented illustrative constants, no external material dataset | MIT OR Apache-2.0 |
+| examples/studio/author_sweep.py | SolidCraft contributors | original editable CAD scene and authoring metadata; no external assets | MIT OR Apache-2.0 |
+| examples/studio/author_scene.py | SolidCraft contributors | original editable CAD scene and authoring metadata; no external assets | MIT OR Apache-2.0 |
+| examples/studio/materials.json | SolidCraft contributors | original editable CAD scene and authoring metadata; no external assets | MIT OR Apache-2.0 |
+| examples/studio/coffee-exploded-sweep.json | SolidCraft contributors | original editable CAD scene and authoring metadata; no external assets | MIT OR Apache-2.0 |
+| examples/studio/coffee-exploded-render.json | SolidCraft contributors | original editable CAD scene and authoring metadata; no external assets | MIT OR Apache-2.0 |
+| examples/studio/coffee-exploded.json | SolidCraft contributors | original editable CAD scene and authoring metadata; no external assets | MIT OR Apache-2.0 |
+| examples/studio/stage1-sweep.json | SolidCraft contributors | original tangent circular-arc CAD cyclorama; no external assets | MIT OR Apache-2.0 |
+| examples/studio/stage1.json | SolidCraft contributors | original editable CAD studio scene; no imported geometry or external image assets | MIT OR Apache-2.0 |
+| examples/studio/stage1-render.json | SolidCraft contributors | original studio camera and lighting parameters | MIT OR Apache-2.0 |
 | examples/render-studio.json | SolidCraft contributors | original procedural box/cylinder enclosure script for the integrated Render workspace | MIT OR Apache-2.0 |
 | examples/render-opaque-studio.json | SolidCraft contributors | original procedural sphere study varying opaque metal fraction and roughness independently; no external assets or engineering data | MIT OR Apache-2.0 |
+| crates/gpu/src/path/denoise.wgsl | SolidCraft contributors | original bounded edge-aware a-trous spatial filter; GPU2 donor d710e31, no external shader source | MIT OR Apache-2.0 |
+| crates/gpu/src/path/denoise_guides.wgsl | SolidCraft contributors | original deterministic centre-ray material and geometry guide pass; GPU2 donor d710e31, no external shader source | MIT OR Apache-2.0 |
+| crates/gpu/src/path/shadows.wgsl | SolidCraft contributors | original bounded area, sun and environment visibility transport; GPU2 donor d710e31, no external shader source | MIT OR Apache-2.0 |
+| crates/gpu/src/path/textures.wgsl | SolidCraft contributors | original planar colour and normal map sampling; GPU2 donor d710e31, no external shader source | MIT OR Apache-2.0 |
+| assets/appearances/starter_pack.rs | SolidCraft contributors | original illustrative optical recipes, authored scalar values and future procedural resource descriptors; no measured or external material dataset | MIT OR Apache-2.0 |
+| examples/material-finishes.json | SolidCraft contributors | original procedural sphere study of six illustrative opaque finishes with generic material densities; no external assets or measured optical data | MIT OR Apache-2.0 |
+| examples/render-path-studio.json | SolidCraft contributors | original procedural opaque enclosure, teal insert and metal fasteners for progressive rendering; no imported models | MIT OR Apache-2.0 |
+| crates/gpu/src/path/path.wgsl | SolidCraft contributors | original software BVH traversal and path integration using the existing SolidCraft surface/studio equations; no external shader source | MIT OR Apache-2.0 |
 | crates/gpu/src/pbr.rs | SolidCraft contributors | original WGSL translation of SolidCraft's opaque surface and fixed studio reference, embedded as Rust source; no external shader code | MIT OR Apache-2.0 |
 | assets/icons/app/macos/source/SolidCraft.icon/icon.json | SolidCraft contributors | approved Icon Composer composition and appearance settings for the original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/app/macos/source/SolidCraft.icon/Assets/02-grid.svg | SolidCraft contributors | original perspective grid with elliptical radial alpha, exported from VectorCraft | MIT OR Apache-2.0 |
@@ -24,14 +49,23 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/icons/app/macos/exports/Assets.car | SolidCraft contributors | Apple actool compilation of assets/icons/app/macos/source/SolidCraft.icon for macOS; contains original artwork only | MIT OR Apache-2.0 |
 | assets/archive/icons/macos-v1/source/icon.vectorcraft | SolidCraft contributors | retained editable historical VectorCraft source, with named face and background layers; redundant exports retired | MIT OR Apache-2.0 |
 | assets/icons/app/macos/exports/icon.icns | SolidCraft contributors | macOS fallback compiled by Apple's actool from the approved assets/icons/app/macos/source/SolidCraft.icon composition | MIT OR Apache-2.0 |
-| docs/screenshots/class-a-blend.png | SolidCraft contributors | screenshot of SolidCraft itself: two boxes bridged by `surface.blend` (a 40x10 sheet, `solidcraft-cli snapshot` of plan/evidence script ev_blend) | MIT OR Apache-2.0 |
-| docs/screenshots/class-a-crown.png | SolidCraft contributors | screenshot of SolidCraft itself: a patch crowned with `surface.patch crown=0.3` over a saddle rim (`solidcraft-cli snapshot`) | MIT OR Apache-2.0 |
-| docs/screenshots/class-a-boundary.png | SolidCraft contributors | screenshot of SolidCraft itself: a patch through two sketch lines built by `surface.boundary` with `crown: 0.4` (`solidcraft-cli snapshot`) | MIT OR Apache-2.0 |
-| docs/screenshots/sample-plate.png | SolidCraft contributors | screenshot of SolidCraft itself (`solidcraft --sample`) | MIT OR Apache-2.0 |
-| docs/screenshots/demo-0.8.gif | SolidCraft contributors | original screen recording of the actual SolidCraft 0.8 English desktop UI modelling an original Raspberry Pi 4 case (no logos or branding; the engraved text is set in the system's DejaVu Sans Bold), generated with examples/demo/record_ui.sh and its original animated pointer overlay (9× playback) | MIT OR Apache-2.0 |
-| docs/screenshots/demo-0.8.mp4 | SolidCraft contributors | original screen recording of the actual SolidCraft 0.8 English desktop UI modelling an original Raspberry Pi 4 case (no logos or branding; the engraved text is set in the system's DejaVu Sans Bold), generated with examples/demo/record_ui.sh and its original animated pointer overlay (9× playback) | MIT OR Apache-2.0 |
-| docs/screenshots/rover-build.gif | 0xlillith (model); SolidCraft contributors (recording) | screen recording of the actual SolidCraft desktop UI replaying the timeline of the SELENE rover (`Rover-recorded.solidcraft` from https://github.com/0xlillith/solidcraft-rover, an original model by 0xlillith built through SolidCraft MCP); the model's lettering follows Ubuntu Light outlines (Canonical Ltd., Ubuntu Font Licence 1.0, as noted in that repository); the emblem is the SolidCraft project icon (2× playback) | MIT OR Apache-2.0 |
-| docs/screenshots/rover-build.mp4 | 0xlillith (model); SolidCraft contributors (recording) | screen recording of the actual SolidCraft desktop UI replaying the timeline of the SELENE rover (`Rover-recorded.solidcraft` from https://github.com/0xlillith/solidcraft-rover, an original model by 0xlillith built through SolidCraft MCP); the model's lettering follows Ubuntu Light outlines (Canonical Ltd., Ubuntu Font Licence 1.0, as noted in that repository); the emblem is the SolidCraft project icon | MIT OR Apache-2.0 |
+| assets/models/test_boat.bin | 3DBenchy.com | 3DBenchy.com | Public Domain |
+| assets/models/make_test_boat.py | SolidCraft contributors | original script that packs a model into the compact file above | MIT OR Apache-2.0 |
+| docs/screenshots/class-a-blend.png | SolidCraft contributors | screenshot of SolidCraft itself: a 24 mm and a 10 mm box bridged by a `surface.blend` sheet (G1 at both edges), rendered by the app's `ui.render` in the dark theme with examples/demo/class_a_shots.py | MIT OR Apache-2.0 |
+| docs/screenshots/class-a-crown.png | SolidCraft contributors | screenshot of SolidCraft itself: a patch crowned with `surface.patch crown=0.3` over a skew four-line rim, rendered by the app's `ui.render` in the dark theme with examples/demo/class_a_shots.py | MIT OR Apache-2.0 |
+| docs/screenshots/class-a-boundary.png | SolidCraft contributors | screenshot of SolidCraft itself: a surface through two 3D sketch splines built by `surface.boundary`, rendered by the app's `ui.render` in the dark theme with examples/demo/class_a_shots.py | MIT OR Apache-2.0 |
+| docs/screenshots/sample-plate.png | SolidCraft contributors | screenshot of SolidCraft 0.22.1 itself (`solidcraft --sample`, default dark theme, 1600x1000) | MIT OR Apache-2.0 |
+| assets/samples/exports/0.png | SolidCraft contributors | original Sample Plate from `crates/engine/src/sample.rs`, exported by the SolidCraft thumbnail renderer | MIT OR Apache-2.0 |
+| assets/samples/exports/1.png | SolidCraft contributors | original Sheet Metal Bracket from `crates/engine/src/sample.rs`, exported by the SolidCraft thumbnail renderer | MIT OR Apache-2.0 |
+| assets/samples/exports/2.png | SolidCraft contributors | original Hinge Assembly from `crates/engine/src/sample.rs`, exported by the SolidCraft thumbnail renderer | MIT OR Apache-2.0 |
+| assets/samples/exports/3.png | SolidCraft contributors | original Plastic Enclosure from `crates/engine/src/sample.rs`, exported by the SolidCraft thumbnail renderer | MIT OR Apache-2.0 |
+| assets/samples/exports/4.png | SolidCraft contributors | original Bolted Flange from `crates/engine/src/sample.rs`, exported by the SolidCraft thumbnail renderer | MIT OR Apache-2.0 |
+| assets/samples/exports/5.png | SolidCraft contributors | original Vent Plate from `crates/engine/src/sample.rs`, exported by the SolidCraft thumbnail renderer | MIT OR Apache-2.0 |
+| assets/samples/exports/scripts.json | SolidCraft contributors | SHA-256 fingerprints of the original sample scripts, generated with the shipped thumbnails | MIT OR Apache-2.0 |
+| docs/screenshots/demo.gif | SolidCraft contributors | original screen recording of the actual SolidCraft 0.22.1 English desktop UI (default dark theme, software renderer) modelling an original Raspberry Pi 4 case (no logos or branding; the engraved text is set in the system's DejaVu Sans Bold), generated with examples/demo/record_ui.sh and its original animated pointer overlay (6× playback, idle pauses cut) | MIT OR Apache-2.0 |
+| docs/screenshots/demo.mp4 | SolidCraft contributors | original screen recording of the actual SolidCraft 0.22.1 English desktop UI (default dark theme, software renderer) modelling an original Raspberry Pi 4 case (no logos or branding; the engraved text is set in the system's DejaVu Sans Bold), generated with examples/demo/record_ui.sh and its original animated pointer overlay (6× playback, idle pauses cut) | MIT OR Apache-2.0 |
+| docs/screenshots/rover-build.gif | 0xlillith (model); SolidCraft contributors (recording) | screen recording of the actual SolidCraft 0.22.1 desktop UI (default dark theme, software renderer) replaying the timeline of the SELENE rover (`Rover-recorded.solidcraft` from https://github.com/0xlillith/solidcraft-rover, an original model by 0xlillith built through SolidCraft MCP); the model's lettering follows Ubuntu Light outlines (Canonical Ltd., Ubuntu Font Licence 1.0, as noted in that repository); the emblem is the SolidCraft project icon (15× playback, idle pauses cut, constant-rate camera orbit) | MIT OR Apache-2.0 |
+| docs/screenshots/rover-build.mp4 | 0xlillith (model); SolidCraft contributors (recording) | screen recording of the actual SolidCraft 0.22.1 desktop UI (default dark theme, software renderer) replaying the timeline of the SELENE rover (`Rover-recorded.solidcraft` from https://github.com/0xlillith/solidcraft-rover, an original model by 0xlillith built through SolidCraft MCP); the model's lettering follows Ubuntu Light outlines (Canonical Ltd., Ubuntu Font Licence 1.0, as noted in that repository); the emblem is the SolidCraft project icon | MIT OR Apache-2.0 |
 | docs/design/ux-redesign/model-floating.png | SolidCraft contributors | original UX mockup (Model tab, floating layout) rendered from an HTML mockup that uses the original Technical Accent icon set; no third-party artwork, and not a screenshot of any other CAD product | MIT OR Apache-2.0 |
 | docs/design/ux-redesign/model-compact.png | SolidCraft contributors | original UX mockup (Model tab, compact docked layout) rendered from an HTML mockup that uses the original Technical Accent icon set; no third-party artwork, and not a screenshot of any other CAD product | MIT OR Apache-2.0 |
 | docs/design/ux-redesign/sketch.png | SolidCraft contributors | original UX mockup (Sketch tab) rendered from an HTML mockup that uses the original Technical Accent icon set; no third-party artwork, and not a screenshot of any other CAD product | MIT OR Apache-2.0 |
@@ -45,8 +79,29 @@ Editable drawing code, native projects and shipped exports are collected under `
 | docs/book/src/generated/enclosure.png | SolidCraft contributors | rendered by `cargo xtask book` (`solidcraft-cli snapshot docs/book/scripts/enclosure.json`; gitignored) | MIT OR Apache-2.0 |
 | docs/book/src/generated/revolve.png | SolidCraft contributors | rendered by `cargo xtask book` (`solidcraft-cli snapshot docs/book/scripts/revolve.json`; gitignored) | MIT OR Apache-2.0 |
 | docs/book/src/generated/sheet-metal.png | SolidCraft contributors | rendered by `cargo xtask book` (`solidcraft-cli snapshot docs/book/scripts/sheet-metal.json`; gitignored) | MIT OR Apache-2.0 |
+| assets/fonts/ibm-plex-mono/IBMPlexMono-Regular.ttf | IBM Corp. (IBM Plex Mono) | https://github.com/IBM/plex (via google/fonts), unmodified; licence text in assets/fonts/ibm-plex-mono/OFL.txt; the interface monospace font | SIL OFL 1.1 |
+| assets/fonts/ibm-plex-sans/IBMPlexSans-Variable.ttf | IBM Corp. (IBM Plex Sans, variable wdth and wght) | https://github.com/IBM/plex (via google/fonts), unmodified; licence text in assets/fonts/ibm-plex-sans/OFL.txt; the default interface font | SIL OFL 1.1 |
+| docs/book/src/generated/tool-preview.png | SolidCraft contributors | rendered by `cargo xtask book` (`solidcraft-cli snapshot docs/book/scripts/tool-preview.json`; gitignored) | MIT OR Apache-2.0 |
 | assets/fonts/liberation-sans/LiberationSans-Regular.ttf | Red Hat, Inc. (Liberation Fonts 2.x; digitized data Google) | https://github.com/liberationfonts (Debian fonts-liberation), unmodified; licence text in assets/fonts/liberation-sans/OFL.txt; used for sketch Text outlines | SIL OFL 1.1 |
 | assets/fonts/biz-udp-gothic/BIZUDPGothic-Regular.ttf | The BIZ UDGothic Project Authors | https://github.com/googlefonts/morisawa-biz-ud-gothic (Google Fonts), unmodified; licence text in assets/fonts/biz-udp-gothic/OFL.txt; used for web UI Japanese font | SIL OFL 1.1 |
+| tests/step-conformance/cone_point.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/cone_point_vertex.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/cylinder.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/cylinder_inch.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/cylinder_nurbs.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/cylinder_placed.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/cylinder_seam.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/cylinder_twice.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/dome.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/dome_nurbs.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/far_cylinder.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/grooved_shaft.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/plate_100_holes.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/sheet_disc.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/tiny_pin.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/torus_ring_nurbs.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/washer.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-regressions/rod_doubled_edge.step | SolidCraft contributors | written by SolidCraft from the commands of #4598 (a bored rod moved 100 mm and exported); import regression fixture | MIT OR Apache-2.0 |
 | tests/oracle/17-loft/reference.stl | SolidCraft contributors | triangulation of our own recipe (tests/oracle/17-loft/recipe.json) built with FreeCAD as an external tool by tools/freecad-oracle | MIT OR Apache-2.0 |
 | tests/oracle/23-bracket-multifeature/reference.stl | SolidCraft contributors | triangulation of our own recipe (tests/oracle/23-bracket-multifeature/recipe.json) built with FreeCAD as an external tool by tools/freecad-oracle | MIT OR Apache-2.0 |
 | tests/oracle/28-blind-pocket-fillets/reference.stl | SolidCraft contributors | triangulation of our own recipe (tests/oracle/28-blind-pocket-fillets/recipe.json) built with FreeCAD as an external tool by tools/freecad-oracle | MIT OR Apache-2.0 |
@@ -67,9 +122,11 @@ Editable drawing code, native projects and shipped exports are collected under `
 | tests/oracle/61-shaft-keyway/reference.stl | SolidCraft contributors | triangulation of our own recipe (tests/oracle/61-shaft-keyway/recipe.json) built with FreeCAD as an external tool by tools/freecad-oracle | MIT OR Apache-2.0 |
 | tests/oracle/63-hinge-knuckle/reference.stl | SolidCraft contributors | triangulation of our own recipe (tests/oracle/63-hinge-knuckle/recipe.json) built with FreeCAD as an external tool by tools/freecad-oracle | MIT OR Apache-2.0 |
 | tests/oracle/65-sketch-gear-tooth/reference.stl | SolidCraft contributors | triangulation of our own recipe (tests/oracle/65-sketch-gear-tooth/recipe.json) built with FreeCAD as an external tool by tools/freecad-oracle | MIT OR Apache-2.0 |
-
 | assets/appearances/library.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/appearances/opaque_finishes.rs | SolidCraft contributors | original illustrative opaque finish values; no external dataset, textures or measured engineering data | MIT OR Apache-2.0 |
 | assets/fonts/biz-udp-gothic/OFL.txt | The BIZ UDGothic Project Authors | Unmodified accompanying font licence | SIL OFL 1.1 |
+| assets/fonts/ibm-plex-mono/OFL.txt | IBM Corp. | Unmodified accompanying font licence | SIL OFL 1.1 |
+| assets/fonts/ibm-plex-sans/OFL.txt | IBM Corp. | Unmodified accompanying font licence | SIL OFL 1.1 |
 | assets/fonts/liberation-sans/OFL.txt | Red Hat, Inc.; Liberation Fonts contributors | Unmodified accompanying font licence | SIL OFL 1.1 |
 | assets/icons/app/linux/exports/hicolor/128x128/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
 | assets/icons/app/linux/exports/hicolor/16x16/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
@@ -79,7 +136,7 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/icons/app/linux/exports/hicolor/48x48/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
 | assets/icons/app/linux/exports/hicolor/512x512/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
 | assets/icons/app/linux/exports/hicolor/64x64/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
-| assets/icons/app/shared/source/app_icon.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/icons/app/shared/source/app_icon.rs | SolidCraft contributors | Original SolidCraft drawing code: the borderless mark, drawn from the faces and gradients of assets/icons/app/macos/source/SolidCraft.icon/Assets/03-solid-blue-cutout.svg | MIT OR Apache-2.0 |
 | assets/icons/app/shared/source/windows_ico.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/icons/app/windows/exports/solidcraft-executable.ico | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
 | assets/icons/app/windows/exports/solidcraft.ico | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
@@ -88,20 +145,31 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/icons/ui/source/navigation.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/icons/ui/source/pointer.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/locales/cs.json | potuzai | Czech translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
+| assets/locales/da.json | SolidCraft contributors | Original Danish translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
 | assets/locales/de.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/locales/en-GB.json | SolidCraft contributors | English (UK): the English catalog's messages whose spelling differs, in UK spelling | MIT OR Apache-2.0 |
 | assets/locales/en.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/locales/es.json | jawler | Spanish (Spain) translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
 | assets/locales/fr.json | rlartot | French translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
 | assets/locales/gl.json | Pablo López (pablopeza) | Galician translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
+| assets/locales/hu.json | SolidCraft contributors | Original Hungarian translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
+| assets/locales/id.json | SolidCraft contributors | Original Indonesian translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
 | assets/locales/it.json | SolidCraft contributors | Original Italian translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
 | assets/locales/ja.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/locales/ko.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/locales/ms.json | A.Hakim (a-hakim) | Malay translation of the English message catalog | MIT OR Apache-2.0 |
+| assets/locales/nb.json | SolidCraft contributors | Original Norwegian Bokmål translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
+| assets/locales/nl.json | SolidCraft contributors | Original Dutch translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
 | assets/locales/pl.json | cyryllo | Polish translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
 | assets/locales/ru.json | Alex Pro (del000) | Russian translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
+| assets/locales/sv.json | SolidCraft contributors | Original Swedish translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
 | assets/locales/pt-BR.json | DuBearte | Brazilian Portuguese translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
+| assets/locales/ro.json | SolidCraft contributors | Original Romanian translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
 | assets/locales/tr.json | macrulz54 | Turkish translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
 | assets/locales/uk.json | Igor Bronovskyi (BrunIF) | Ukrainian translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
+| assets/locales/vi.json | vandang890615 | Vietnamese translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
 | assets/locales/zh.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/locales/zh-TW.json | SolidCraft contributors | Original Traditional Chinese (Taiwan) translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
 | assets/materials/library.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/platforms/linux/ai.storyteller.solidcraft.desktop | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
 | assets/platforms/linux/ai.storyteller.solidcraft.metainfo.xml.in | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
@@ -118,6 +186,22 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/styles/ui/themes/gruvbox-light.json | SolidCraft contributors | original SolidCraft theme file mapping SolidCraft's UI colours to the Gruvbox palette's colour values (Gruvbox by Pavel Pertsev, https://github.com/morhetz/gruvbox, MIT) | MIT OR Apache-2.0 |
 | assets/styles/ui/themes/gruvbox-light-hard.json | SolidCraft contributors | original SolidCraft theme file mapping SolidCraft's UI colours to the Gruvbox palette's colour values (Gruvbox by Pavel Pertsev, https://github.com/morhetz/gruvbox, MIT) | MIT OR Apache-2.0 |
 | assets/styles/ui/themes/gruvbox-light-soft.json | SolidCraft contributors | original SolidCraft theme file mapping SolidCraft's UI colours to the Gruvbox palette's colour values (Gruvbox by Pavel Pertsev, https://github.com/morhetz/gruvbox, MIT) | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/solidcraft-95.json | SolidCraft contributors | original SolidCraft theme file | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/platinum-9.json | SolidCraft contributors | original SolidCraft theme file | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/cupertino.json | SolidCraft contributors | original SolidCraft theme file | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/green-phosphor.json | SolidCraft contributors | original SolidCraft theme file | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/amber-phosphor.json | SolidCraft contributors | original SolidCraft theme file | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/blueprint.json | SolidCraft contributors | original SolidCraft theme file | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/one-dark.json | SolidCraft contributors | original SolidCraft theme file with colours adapted from the One Dark palette (Atom One Dark by GitHub Atom, https://github.com/atom/atom, MIT) | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/tokyo-night.json | SolidCraft contributors | original SolidCraft theme file adapting the colours of a published palette (Tokyo Night by enkia, https://github.com/enkia/tokyo-night-vscode-theme, MIT) | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/solarized-light.json | SolidCraft contributors | original SolidCraft theme file adapting the colours of a published palette (Solarized by Ethan Schoonover, https://github.com/altercation/solarized, MIT) | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/nord.json | SolidCraft contributors | original SolidCraft theme file adapting the colours of a published palette (Nord by Sven Greb and the Nord contributors, https://github.com/nordtheme/nord, MIT) | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/high-contrast.json | SolidCraft contributors | original SolidCraft theme file | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/graphite.json | SolidCraft contributors | original SolidCraft theme file | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/nosferatu.json | SolidCraft contributors | original SolidCraft theme file adapting the colours of a published palette (Dracula by Zeno Rocha and the Dracula Theme contributors, https://github.com/dracula/dracula-theme, MIT) | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/catppuccin-mocha.json | SolidCraft contributors | original SolidCraft theme file adapting the colours of a published palette (Catppuccin by the Catppuccin organisation, https://github.com/catppuccin/catppuccin, MIT) | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/okibi.json | SolidCraft contributors (Kai Evans) | original SolidCraft theme file mapping SolidCraft's UI colours to the Okibi palette (dark) of the Okibi design system by Kai Evans (https://kaievns.github.io/okibi-akiri-design-system-spec/) | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/akari.json | SolidCraft contributors (Kai Evans) | original SolidCraft theme file mapping SolidCraft's UI colours to the Akari palette (light) of the Okibi design system by Kai Evans (https://kaievns.github.io/okibi-akiri-design-system-spec/) | MIT OR Apache-2.0 |
 | assets/styles/web/loading-logo.svg | SolidCraft contributors | Animation of the SolidCraft mark, built from the paths and gradients of assets/icons/app/macos/source/SolidCraft.icon/Assets/03-solid-blue-cutout.svg; original animation | MIT OR Apache-2.0 |
 | assets/styles/web/loading.css | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | crates/io/src/native_cad/fixtures/block.FCStd | SolidCraft contributors | original 10 × 20 × 30 mm test box saved by FreeCAD 1.1.4 run as an external program (`make_block_fcstd.py` beside it); no third-party geometry | MIT OR Apache-2.0 |
@@ -126,6 +210,10 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/icons/ui/design/palette.toml | SolidCraft contributors | icon colour roles (light and dark) and accents, original SolidCraft data | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/flat/bug_report.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/flat/chevron.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/chevron_right.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/close.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/disclosure_closed.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/disclosure_open.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/flat/fit.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/flat/folder.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/flat/help.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
@@ -134,11 +222,17 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/icons/ui/design/svg/flat/moon.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/flat/nav_settings.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/flat/orbit.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/plus.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/flat/pan.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/flat/perspective.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/flat/redo.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/flat/save.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/flat/settings.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/settings_keyboard.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/settings_monitor.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/settings_mouse.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/settings_palette.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/settings_plug.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/flat/spin.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/flat/style.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/flat/undo.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
@@ -219,7 +313,7 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/icons/ui/design/svg/model/export.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/extend.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/extrude.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
-| assets/icons/ui/design/svg/model/eye.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/eye.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/fastener.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/fillet.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/filter.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
@@ -269,6 +363,18 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/icons/ui/design/svg/model/pattern_rect.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/perforate.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/pipe.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/silhouette.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/assistant.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/agent_link.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/offset_two_sides.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/offset_symmetric.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/import_tray.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/export_tray.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/send.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/stop.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/shield.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/status_recovery.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/frame_member.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/placeholder.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/plane.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/plane_angle.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
@@ -320,7 +426,7 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/icons/ui/design/svg/model/status_error.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/status_warning.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/stitch.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
-| assets/icons/ui/design/svg/model/suppress.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/suppress.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/surface.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/svg.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/sweep.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
@@ -404,10 +510,13 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/icons/ui/design/tools/lint_icons.py | SolidCraft contributors | icon lint, status page or preview tool (standard-library Python), original SolidCraft code | MIT OR Apache-2.0 |
 | assets/icons/ui/design/tools/preview.py | SolidCraft contributors | icon lint, status page or preview tool (standard-library Python), original SolidCraft code | MIT OR Apache-2.0 |
 | assets/icons/ui/design/tools/review_state.py | SolidCraft contributors | icon review state helper (standard-library Python), original SolidCraft code | MIT OR Apache-2.0 |
+| assets/icons/ui/design/requested_icons.txt | SolidCraft contributors | Runtime icon requests collected by the headless menu audit, original SolidCraft data | MIT OR Apache-2.0 |
 | assets/icons/ui/design/review.json | SolidCraft contributors | icon review state (accepted icons and notes), original SolidCraft data | MIT OR Apache-2.0 |
 | assets/icons/ui/design/tools/author/lib.py | SolidCraft contributors | icon authoring script (standard-library Python), original SolidCraft code | MIT OR Apache-2.0 |
 
 | docs/book/src/og.png | SolidCraft contributors | copy of assets/branding/web/source/og.png staged by cargo xtask book (gitignored) | MIT OR Apache-2.0 |
+| docs/sponsors/blacksmith-ci-powered.png | Blacksmith (blacksmith.sh) | "CI powered by Blacksmith" sponsor banner supplied by Blacksmith for the sponsorship credit; used only to credit the sponsor, not part of the application | © Blacksmith, used with permission |
+| assets/icons/ui/design/svg/model/path_flange.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
 
 ## Code adapted from sibling projects
 
@@ -450,9 +559,9 @@ crates/engine/src/tests/gltf_import.rs); no third-party models are committed.
 ## FreeCAD and Rhino import library
 
 FreeCAD `.FCStd` and Rhino `.3dm` files are read with [cadmpeg](https://github.com/cadmpeg/cadmpeg)
-0.6.1 (Apache-2.0), linked as the crates `cadmpeg-core`, `cadmpeg-ir`, `cadmpeg-registry`,
+0.6.3 (Apache-2.0), linked as the crates `cadmpeg-core`, `cadmpeg-ir`, `cadmpeg-registry`,
 `cadmpeg-container`, `cadmpeg-codec-freecad`, `cadmpeg-codec-rhino` and `cadmpeg-codec-step`
-in native builds (`crates/io/src/native_cad.rs`). Only those open-format codecs are built: no
+in native and browser builds (`crates/io/src/native_cad.rs`). Only those open-format codecs are built: no
 default features, so cadmpeg's codecs for commercial CAD formats and its ShapeManager/ACIS
 codec are not compiled in. Its licence text is in THIRD-PARTY-LICENSES.txt; no code from it is
 copied into SolidCraft.
@@ -469,7 +578,7 @@ copied into SolidCraft.
 |---|---|---|---|
 | vendor/truck-meshalgo | truck-meshalgo 0.4.0, https://github.com/ricosjp/truck (RICOS Co. Ltd.) | Apache-2.0 | meshing: bounded parameter searches, collapsed-boundary projection, subdivision and provisional fixed-grid previews (vendor/README.md) |
 | vendor/truck-stepio | truck-stepio 0.3.0, https://github.com/ricosjp/truck (RICOS Co. Ltd.) | Apache-2.0 | STEP writer: intersection-curve surfaces written at unique ids (vendor/README.md) |
-| vendor/truck-shapeops | truck-shapeops 0.4.0, https://github.com/ricosjp/truck (RICOS Co. Ltd.) | Apache-2.0 | robust meshing and nearest-parameter fallback in booleans; degenerate intersection-curve rejection; face and edge history of booleans; trace macro; corner choice at vertices several intersection curves end on (vendor/README.md) |
+| vendor/truck-shapeops | truck-shapeops 0.4.0, https://github.com/ricosjp/truck (RICOS Co. Ltd.) | Apache-2.0 | robust meshing and nearest-parameter fallback in booleans; degenerate intersection-curve rejection; face and edge history of booleans; trace macro; corner choice at vertices several intersection curves end on; reuse of an operand's meshes (vendor/README.md) |
 | vendor/truck-geometry | truck-geometry 0.5.0, https://github.com/ricosjp/truck (RICOS Co. Ltd.) | Apache-2.0 | intersection curves divided from their neighbours' surface parameters; surface second derivatives (vendor/README.md) |
 | vendor/matext4cgmath | matext4cgmath 0.1.0, https://github.com/ricosjp/matext4cgmath (RICOS Co. Ltd.) | Apache-2.0 | root refinement stops after 100 Newton steps (vendor/README.md) |
 
@@ -485,3 +594,453 @@ A frame whose meshes the GPU refuses to stage (device lost or out of memory) is
 skipped with a warning instead of panicking (#1469).
 Paint callbacks are prepared only after a drawable is acquired, so a skipped
 surface frame cannot strand cached meshes without their GPU initialization.
+
+## Runtime studio lighting mathematics
+
+`crates/gpu/src/path/path.wgsl` implements the power-heuristic estimator from the
+mathematical description in [PBRT fourth edition, section 13.4](https://pbr-book.org/4ed/Light_Transport_I_Surface_Reflection/A_Better_Path_Tracer).
+No PBRT code or assets were copied. `crates/render/src/job/lighting.rs` evaluates
+[Krzysztof Narkowicz's published 2016 ACES rational fit](https://knarkowicz.wordpress.com/2016/01/06/aces-filmic-tone-mapping-curve/)
+using its published coefficients (author licenses the fit under CC0/MIT).
+These original implementations are under SolidCraft's MIT OR Apache-2.0 licence.
+
+## Original coffee framing variant
+
+| File | Author | Provenance | Licence |
+|---|---|---|---|
+| examples/studio/author_coffee_framing.py | SolidCraft contributors | original editable composition, camera and documentation; no external assets | MIT OR Apache-2.0 |
+| examples/studio/coffee-framing.json | SolidCraft contributors | original editable composition, camera and documentation; no external assets | MIT OR Apache-2.0 |
+| examples/studio/coffee-framing-sweep.json | SolidCraft contributors | original editable composition, camera and documentation; no external assets | MIT OR Apache-2.0 |
+| examples/studio/coffee-framing-render.json | SolidCraft contributors | original editable composition, camera and documentation; no external assets | MIT OR Apache-2.0 |
+| examples/studio/coffee-framing.md | SolidCraft contributors | original editable composition, camera and documentation; no external assets | MIT OR Apache-2.0 |
+
+## Original cylindrical coffee housing variant
+
+| File | Author | Provenance | Licence |
+|---|---|---|---|
+| examples/studio/author_coffee_cylinder.py | SolidCraft contributors | original parametric cylindrical CAD construction and editable command recipes; no external assets | MIT OR Apache-2.0 |
+| examples/studio/coffee-cylinder.json | SolidCraft contributors | original cylindrical housing on the original exploded coffee composition; no external assets | MIT OR Apache-2.0 |
+| examples/studio/coffee-cylinder-sweep.json | SolidCraft contributors | original cylindrical housing and continuous CAD cyclorama; no external assets | MIT OR Apache-2.0 |
+| examples/studio/coffee-cylinder-render.json | SolidCraft contributors | original camera, studio lighting and optical settings retained from the framing variant | MIT OR Apache-2.0 |
+| examples/studio/coffee-cylinder.md | SolidCraft contributors | original dimensional recipe, provenance and validation limitations | MIT OR Apache-2.0 |
+
+## Runtime environment sampling
+
+`crates/render/src/lighting/environment.rs` and the environment/sun portions of
+`crates/gpu/src/path/path.wgsl` are original SolidCraft implementations of
+solid-angle importance sampling and MIS, informed by the mathematical description
+in [PBRT fourth edition, sections 12.5](https://pbr-book.org/4ed/Light_Sources/Infinite_Area_Lights)
+and [13.4](https://pbr-book.org/4ed/Light_Transport_I_Surface_Reflection/A_Better_Path_Tracer).
+The procedural gradient and inline RGBE test fixtures are original mathematical
+colours, not downloaded imagery. No third-party environment images or shader code
+are included. Licence: MIT OR Apache-2.0.
+
+## Original tumbler showcase assets
+
+The CAD room, tumblers, window opening, wood/weave patterns and RGBE sky below
+are original SolidCraft contributor work. No third-party scene, photograph, HDRI,
+texture, or AI-generated artwork was used. Python authoring sources are included.
+All listed files use the repository MIT OR Apache-2.0 licence.
+
+| File | Source / author | Use | License |
+| --- | --- | --- | --- |
+| examples/studio/author_showcase.py | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/author_tumblers.py | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/textures/ATTRIBUTION.md | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/textures/author_textures.py | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/textures/environment-manifest.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/textures/manifest.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/tumblers-hdr-textures-blocked-render.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/tumblers-hdr-textures-render.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/tumblers-materials.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/tumblers-render.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/tumblers-sun-render.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/tumblers-sun-textures-blocked-render.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/tumblers-sun-textures-render.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/tumblers-sun.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/tumblers-textures-blocked-render.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/tumblers-textures-render.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/tumblers.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+
+The original studio generators produce local ignored PNG maps and an RGBE gradient.
+Generated image bytes are not source assets; their authorship, licences and expected
+hashes are documented under `examples/studio/textures`. Rendered evidence belongs
+on the results branch. No photographs, scans or external image assets are included.
+
+## Additional render and showcase resources
+
+| File | Author | Source | Licence |
+|---|---|---|---|
+| assets/render/starter/tools/check_all.py | SolidCraft contributors | original read-only authored/native resource validation orchestration and evidence receipts | MIT OR Apache-2.0 |
+| assets/render/starter/tools/test_check_all.py | SolidCraft contributors | original validation-runner regression fixtures and subprocess tests | MIT OR Apache-2.0 |
+| assets/render/starter/tools/requirements.txt | SolidCraft contributors | pinned offline authoring tool requirements; no application dependency changes | MIT OR Apache-2.0 |
+| crates/render/examples/validate_starter.rs | SolidCraft contributors | original native resource conformance checker using public SolidCraft decoding, normalization, sampling and mip APIs | MIT OR Apache-2.0 |
+| .gitattributes | SolidCraft contributors | original canonical line-ending policy for the existing runtime icon-discovery manifest; no artwork or icon-assignment changes | MIT OR Apache-2.0 |
+| assets/render/.gitattributes | SolidCraft contributors | original canonical line-ending policy for SHA-256-pinned renderer authoring resources | MIT OR Apache-2.0 |
+| docs/render-materials/.gitattributes | SolidCraft contributors | original canonical line-ending policy for SHA-256-pinned renderer authoring resources | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/assembly-bench-soft.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/automotive-turntable.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/black-metal-strips.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/cnc-overhead.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/esd-bench-neutral.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/fdm-neutral-inspection.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/garage-door.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/hangar-skylight.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/home-workbench.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/makerspace-worklights.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/mechanical-bay.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/neutral-comparison.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/neutral-side-softbox.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/paint-inspection-bands.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/printed-part-photo.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/rework-offset-strips.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/robot-led-editorial.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/showroom-ribbons.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/spacecraft-clean-bay.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/sun-free-overcast.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/vacuum-black.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/warm-table-window.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/white-enveloping-studio.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/woodshop-window.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/manifest.json | SolidCraft contributors | original clean-room renderer resource recipe or manifest; authored/unbound scope and source receipts in assets/render/starter/README.md | MIT OR Apache-2.0 |
+| assets/render/starter/environments/source/recipes.json | SolidCraft contributors | original clean-room renderer resource recipe or manifest; authored/unbound scope and source receipts in assets/render/starter/README.md | MIT OR Apache-2.0 |
+| assets/render/starter/lighting/exports/rigs.json | SolidCraft contributors | original clean-room renderer resource recipe or manifest; authored/unbound scope and source receipts in assets/render/starter/README.md | MIT OR Apache-2.0 |
+| assets/render/starter/lighting/recipe.json | SolidCraft contributors | original clean-room renderer resource recipe or manifest; authored/unbound scope and source receipts in assets/render/starter/README.md | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-001/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-001/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-001/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-001/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-001/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-002/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-002/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-002/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-002/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-002/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-003/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-003/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-003/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-003/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-003/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-004/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-004/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-004/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-004/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-004/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-005/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-005/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-005/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-005/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-005/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-006/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-006/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-006/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-006/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-006/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-007/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-007/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-007/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-007/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-007/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-008/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-008/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-008/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-008/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-008/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-009/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-009/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-009/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-009/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-009/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-010/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-010/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-010/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-010/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-010/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-011/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-011/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-011/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-011/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-011/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-012/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-012/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-012/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-012/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-012/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-013/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-013/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-013/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-013/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-013/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-014/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-014/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-014/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-014/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-014/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-015/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-015/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-015/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-015/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-015/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-016/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-016/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-016/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-016/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-016/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-017/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-017/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-017/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-017/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-017/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-018/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-018/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-018/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-018/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-018/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-019/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-019/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-019/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-019/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-019/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-020/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-020/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-020/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-020/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-020/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-021/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-021/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-021/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-021/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-021/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-022/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-022/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-022/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-022/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-022/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-023/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-023/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-023/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-023/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-023/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-024/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-024/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-024/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-024/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-024/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-025/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-025/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-025/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-025/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-025/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-026/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-026/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-026/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-026/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-026/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-027/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-027/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-027/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-027/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-027/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-028/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-028/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-028/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-028/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-028/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-029/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-029/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-029/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-029/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-029/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-030/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-030/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-030/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-030/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-030/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-031/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-031/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-031/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-031/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-031/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-032/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-032/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-032/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-032/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-032/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-033/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-033/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-033/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-033/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-033/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-034/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-034/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-034/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-034/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-034/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-035/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-035/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-035/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-035/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-035/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-036/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-036/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-036/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-036/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-036/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-037/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-037/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-037/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-037/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-037/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-038/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-038/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-038/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-038/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-038/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-039/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-039/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-039/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-039/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-039/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-040/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-040/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-040/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-040/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-040/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-041/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-041/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-041/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-041/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-041/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-042/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-042/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-042/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-042/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-042/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-043/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-043/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-043/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-043/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-043/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-044/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-044/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-044/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-044/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-044/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-045/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-045/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-045/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-045/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-045/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-046/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-046/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-046/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-046/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-046/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-047/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-047/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-047/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-047/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-047/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-048/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-048/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-048/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-048/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-048/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/manifest.json | SolidCraft contributors | original clean-room renderer resource recipe or manifest; authored/unbound scope and source receipts in assets/render/starter/README.md | MIT OR Apache-2.0 |
+| assets/render/starter/materials/source/recipes.json | SolidCraft contributors | original clean-room renderer resource recipe or manifest; authored/unbound scope and source receipts in assets/render/starter/README.md | MIT OR Apache-2.0 |
+| assets/render/starter/pack.json | SolidCraft contributors | original clean-room renderer resource recipe or manifest; authored/unbound scope and source receipts in assets/render/starter/README.md | MIT OR Apache-2.0 |
+| assets/render/starter/tools/environments.py | SolidCraft contributors | original clean-room offline resource authoring, numerical verification or validation tool; no application runtime dependency | MIT OR Apache-2.0 |
+| assets/render/starter/tools/lighting.py | SolidCraft contributors | original clean-room offline resource authoring, numerical verification or validation tool; no application runtime dependency | MIT OR Apache-2.0 |
+| assets/render/starter/tools/materials.py | SolidCraft contributors | original clean-room offline resource authoring, numerical verification or validation tool; no application runtime dependency | MIT OR Apache-2.0 |
+| assets/render/starter/tools/test_environments.py | SolidCraft contributors | original clean-room offline resource authoring, numerical verification or validation tool; no application runtime dependency | MIT OR Apache-2.0 |
+| assets/render/starter/tools/test_lighting.py | SolidCraft contributors | original clean-room offline resource authoring, numerical verification or validation tool; no application runtime dependency | MIT OR Apache-2.0 |
+| assets/render/starter/tools/test_materials.py | SolidCraft contributors | original clean-room offline resource authoring, numerical verification or validation tool; no application runtime dependency | MIT OR Apache-2.0 |
+| assets/render/starter/tools/validate_pack.py | SolidCraft contributors | original clean-room offline resource authoring, numerical verification or validation tool; no application runtime dependency | MIT OR Apache-2.0 |
+| assets/render/selene/licenses/UFL.txt | Canonical Ltd. | exact Ubuntu Font Licence 1.0 notice retained from https://github.com/0xlillith/solidcraft-rover/blob/b32437915372d32b71419dc8f5143fe22ff1e869/UFL.txt for the modelled Ubuntu Light lettering | Ubuntu Font Licence 1.0 |
+| assets/render/selene/materials/appearance-pack.json | SolidCraft contributors | original clean-room English appearance authoring data: 48 illustrative opaque PBR projections with separate advanced target specifications; no measured dataset or external assets | MIT OR Apache-2.0 |
+| assets/render/selene/materials/appearance-swatches.json | SolidCraft contributors | original analytic command script for 48 opaque box swatches and a support base, derived only from the adjacent original appearance pack; no external artwork or engineering properties | MIT OR Apache-2.0 |
+| assets/render/selene/models/SELENE-functional.solidcraft | SolidCraft contributors (native enhancements); 0xlillith (original rover); SychPL / Mateusz Sych (supplied showcase assembly); Canonical Ltd. (lettering outlines) | native-command derivative of the unchanged author-supplied source, with original bearing, suspension, gripper, electronics and presentation work; source and final hashes in assets/render/selene/SOURCE.md and VALIDATION.md | Model and showcase contributions: MIT OR Apache-2.0 (explicit SychPL grant https://github.com/tangency-labs/solidcraft/pull/5494#issuecomment-6375788360); lettering: Ubuntu Font Licence 1.0, notice retained in assets/render/selene/licenses/UFL.txt |
+| assets/render/selene/motion/interference-pairs.json | SolidCraft contributors | original authored exact-body pair selection for bounded native clearance checks on the functional SELENE derivative; not a generated collision result | MIT OR Apache-2.0 |
+| assets/render/selene/motion/mechanism-acceptance.json | SolidCraft contributors | original kinematic acceptance criteria, inspected source-container bindings and analytic planning checks from cited public SolidCraft documentation and the admitted native source; derivative runtime acceptance is recorded separately | MIT OR Apache-2.0 |
+| assets/render/selene/motion/preflight-commands.json | SolidCraft contributors | original read-only inventory script using existing project commands; no source-model selectors or state mutations | MIT OR Apache-2.0 |
+| assets/render/selene/motion/sample-sequence.json | SolidCraft contributors | original future lunar sampling and sealed-vial dynamics state specification; no simulation or physical calibration result | MIT OR Apache-2.0 |
+| assets/render/selene/scenes/roles.json | SolidCraft contributors | original semantic role and candidate-material authoring specification for the prepared SELENE demo; no native geometry or external assets bundled | MIT OR Apache-2.0 |
+| assets/render/selene/scenes/shots.json | SolidCraft contributors | original shot, framing and staged-sequence authoring specification for the prepared SELENE demo; no render or simulation result claimed | MIT OR Apache-2.0 |
+| assets/render/selene/scenes/stages.json | SolidCraft contributors | original stage composition and light-ownership authoring specification derived from the project render catalog; scientific context linked in scenes/README.md | MIT OR Apache-2.0 |
+| assets/render/selene/source-lock.json | SolidCraft contributors | original source-admission metadata and public-reference inventory pinning the supplied improved SELENE native file; original-model and font notices preserved in SOURCE.md | MIT OR Apache-2.0 |
+| assets/render/selene/source/SELENE-showcase.solidcraft | 0xlillith (original rover); SychPL / Mateusz Sych (showcase assembly and helpers); SolidCraft contributors (emblem); Canonical Ltd. (lettering outlines) | unchanged author-published native file from https://github.com/SychPL/solidcraft/blob/32ec1720447e3fcc6bb6cc53a63fb5b39cfa21b9/SELENE-showcase.solidcraft; source hash and license evidence in assets/render/selene/SOURCE.md | Model and showcase contributions: MIT OR Apache-2.0 (explicit SychPL grant https://github.com/tangency-labs/solidcraft/pull/5494#issuecomment-6375788360); lettering: Ubuntu Font Licence 1.0, notice retained in assets/render/selene/licenses/UFL.txt |
+| assets/render/selene/tools/bearings.py | SolidCraft contributors | original native-command authoring of grooved bearings, rolling-element kinematics, clamp hubs and arm/head clearances; analytic geometry, no copied CAD source | MIT OR Apache-2.0 |
+| assets/render/selene/tools/build.py | SolidCraft contributors | original Python development tool for pinned-source native command replay, staged checkpoints, command-trace and geometry health checks; no application runtime dependency | MIT OR Apache-2.0 |
+| assets/render/selene/tools/electronics.py | SolidCraft contributors | original native-command Raspberry Pi 5 visual reconstruction using public manufacturer mechanical dimensions; original package envelopes and connector internals, no manufacturer CAD or artwork copied | MIT OR Apache-2.0 |
+| assets/render/selene/tools/export_views.py | SolidCraft contributors | original native MCP preview export tool for three reusable showcase views; changes only transient visibility and cameras and verifies the source master hash | MIT OR Apache-2.0 |
+| assets/render/selene/tools/finishes.py | SolidCraft contributors | original native physical-material proxy and opaque PBR assignment generator preserving the supplied rover palette | MIT OR Apache-2.0 |
+| assets/render/selene/tools/mechanisms.py | SolidCraft contributors | original native-command gripper sleeves, pads, wheel ownership, joint limits and inspection studies with independent analytic suspension relation | MIT OR Apache-2.0 |
+| assets/render/selene/tools/prepare.py | SolidCraft contributors | original Python development tool for bounded native-container inspection and reviewed opaque body-assignment preparation; no application runtime dependency | MIT OR Apache-2.0 |
+| assets/render/selene/tools/presentation.py | SolidCraft contributors | original native-command browser organization, camera/render setups and closed sample-vial glass preparation | MIT OR Apache-2.0 |
+| assets/render/selene/tools/suspension.py | SolidCraft contributors | original native-command trailing-arm suspension, telescoping coilover loops, plain bushings, carrier gussets and local motion clearances derived from the admitted rover geometry; independent analytic pin-distance relation, no copied external CAD | MIT OR Apache-2.0 |
+| assets/render/selene/tools/validate_native.py | SolidCraft contributors | original bounded native MCP verification tool for sampled SELENE kinematics, independent analytic follower and world-coordinate checks, optional exact-name interference pairs and unchanged input hashes; no application runtime dependency | MIT OR Apache-2.0 |
+| assets/render/selene/tools/validate_prepared.py | SolidCraft contributors | original Python development validator for prepared SELENE resources, source status, references, hashes and command projections; no application runtime dependency | MIT OR Apache-2.0 |
+| assets/render/selene/tools/yaw_supports.py | SolidCraft contributors | original native-command plain yaw journals, flanged brass thrust bushings, recessed axial retaining pins and mounting-head clearances derived from the admitted rover geometry; no copied external CAD | MIT OR Apache-2.0 |
+| assets/render/selene/ui/demo-flow.json | SolidCraft contributors | original progressive-disclosure UI integration specification for the existing Render workspace; no copied UI artwork or runtime registration | MIT OR Apache-2.0 |
+| docs/render-materials/baseline-setup-commands.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/capabilities.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/environment-presets.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/environments.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/lighting.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/lunar-physics-fixtures.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/materials.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/provenance.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/quality-presets.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/roadmap.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/scene-presets.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/selene-bindings.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/simulation-requirements.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/studio-presets.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/ui-integration.json | SolidCraft contributors | original English UI integration specification and exact source-revision mappings from SolidCraft's own implemented shell, UI kit and accepted icons; no copied artwork or runtime registration | MIT OR Apache-2.0 |
+| docs/render-materials/ux.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/validate_catalog.py | SolidCraft contributors | original Python development validator for catalog references, preset composition and analytic specification fixtures; no application runtime dependency | MIT OR Apache-2.0 |
+
+### Built-in render resource adapters (personal integration batch, 2026-10-22)
+
+The original adapters in `crates/engine/src/cmd/render/library.rs`, the generated lookup `library_data.rs` and its generator `tools/render-library/generate.py` project the already attributed starter and SELENE resources without replacing their bytes or authoring manifests. The added scalar texture channels, explicit color/V conventions and immutable-source/GPU-payload sharing are original contributor work under MIT OR Apache-2.0. No external code, commercial CAD data or new third-party imagery was imported. Source metadata and the original authoring attribution remain authoritative; pending runtime acceptance is not a photometric or engineering qualification.
+
+## Physical reference resource additions
+
+| File | Author | Source | Licence |
+|---|---|---|---|
+| assets/render/physical/bindings.json | SolidCraft contributors | original physical-reference curation, associations or derived schema-1 export; per-fact public sources retained without relicensing their publications | MIT OR Apache-2.0 |
+| assets/render/physical/exports/coverage.json | SolidCraft contributors | original physical-reference curation, associations or derived schema-1 export; per-fact public sources retained without relicensing their publications | MIT OR Apache-2.0 |
+| assets/render/physical/exports/native-cards.json | SolidCraft contributors | original physical-reference curation, associations or derived schema-1 export; per-fact public sources retained without relicensing their publications | MIT OR Apache-2.0 |
+| assets/render/physical/profiles.json | SolidCraft contributors | original physical-reference curation, associations or derived schema-1 export; per-fact public sources retained without relicensing their publications | MIT OR Apache-2.0 |
+| assets/render/physical/quantities.json | SolidCraft contributors | original physical-reference curation, associations or derived schema-1 export; per-fact public sources retained without relicensing their publications | MIT OR Apache-2.0 |
+| assets/render/physical/sources.json | SolidCraft contributors | original physical-reference curation, associations or derived schema-1 export; per-fact public sources retained without relicensing their publications | MIT OR Apache-2.0 |
+| assets/render/physical/tools/check_physical.py | SolidCraft contributors | original offline physical-reference validation and projection tool | MIT OR Apache-2.0 |
+| assets/render/physical/tools/physical.py | SolidCraft contributors | original offline physical-reference validation and projection tool | MIT OR Apache-2.0 |
+| assets/render/physical/tools/test_physical.py | SolidCraft contributors | original offline physical-reference validation and projection tool | MIT OR Apache-2.0 |
+| assets/render/physical/tools/export_library.py | SolidCraft contributors | original explicit reference-library planner and native no-loss export verifier; no external code | MIT OR Apache-2.0 |
+| assets/render/physical/tools/test_export_library.py | SolidCraft contributors | original regressions for native capability refusal, source identity and physical-card preservation | MIT OR Apache-2.0 |
+
+| tools/render-library/selene_studio.py | SolidCraft contributors | original bounded native MCP studio orchestration with pinned editable master, explicit GPU policy and request/export receipts; no generated model or image substitutes | MIT OR Apache-2.0 |
+
+| tools/render-library/selene_recipe.py | SolidCraft contributors | original full-detail SELENE material/light composition and analytic camera fit; unchanged pinned native master, no external imagery or measured optical dataset | MIT OR Apache-2.0 |
+| tools/render-library/test_selene_recipe.py | SolidCraft contributors | original independent projection, scaling, nonmutation and input-refusal fixtures for the SELENE studio recipe | MIT OR Apache-2.0 |
+
+| assets/render/selene/scenes/studio-hero.json | SolidCraft contributors | original executable render intent and verified provenance for the selected native SELENE studio showcase; authored RGB appearance and relative light units, not measured optics or simulation results | MIT OR Apache-2.0 |
+| tools/render-library/publish_selene.py | SolidCraft contributors | original bounded native-frame publication checks for explicit visual review, source identity, resource hashes, PNG CRCs and scanline limits; copies completed native bytes without image synthesis or resampling | MIT OR Apache-2.0 |
+| tools/render-library/test_publish_selene.py | SolidCraft contributors | original tiny analytic PNG fixtures for source-size, CRC, expansion, dimensions and explicit-publication-consent regressions | MIT OR Apache-2.0 |
+
+| tools/render-library/package_selene.py | SolidCraft contributors | original byte-preserving packaging of the reviewed native SELENE PNG, public provenance and checksums; bounded resource/PNG verification, no fonts, executables or new render execution | MIT OR Apache-2.0 |
+| .github/workflows/selene-showcase.yml | SolidCraft contributors | original read-only artifact-delivery workflow for the reviewed native SELENE export; existing pinned repository actions, no compilation, package installation, secret use or renderer claims | MIT OR Apache-2.0 |
+
+| tools/render-library/verify_linear_master.py | SolidCraft contributors | original independent validation driver for native linear EXR output using the official OpenEXR Python reader as an external test oracle; no codec implementation copied or production dependency added | MIT OR Apache-2.0 |
+
+## Aging, effects and backgrounds showcase, 2026-10-23
+
+| File | Author | Source | Licence |
+|---|---|---|---|
+| tools/render-showcase/instrument.py | SolidCraft contributors | original native-scene authoring, checksum-verified editorial assembly or bounded delivery tool; no third-party source or font binary copied | MIT OR Apache-2.0 |
+| tools/render-showcase/compose.py | SolidCraft contributors | original native-scene authoring, checksum-verified editorial assembly or bounded delivery tool; no third-party source or font binary copied | MIT OR Apache-2.0 |
+| tools/render-showcase/package.py | SolidCraft contributors | original native-scene authoring, checksum-verified editorial assembly or bounded delivery tool; no third-party source or font binary copied | MIT OR Apache-2.0 |
+
+| distribution/SolidCraft-Render-Showcase.zip | SolidCraft contributors and the explicitly credited original model/UI/resource authors | byte-verified selected collaborator package of reviewed native media, editable sample, recipes and public provenance; contained attribution and existing SELENE lettering notices retained; no fonts or executable binaries | MIT OR Apache-2.0 for new contributions; referenced original notices retained |
+| distribution/SolidCraft-Render-Showcase.json | SolidCraft contributors | original verified delivery archive manifest with exact SHA-256, member count and bounded scope | MIT OR Apache-2.0 |

CLAUDE.md

@@ -1,183 +1,3 @@
-# SolidCraft — instructions for agents
+@AGENTS.md
 
-SolidCraft is a clean-room, open-source, pure-Rust parametric 3D CAD application:
-sketches with a constraint solver, a parametric timeline of features, a B-rep
-kernel, and a desktop UI that agents can drive. Projects published by
-[storytold](https://github.com/storytold) can serve as references for implementation conventions.
-Any code adapted from other projects (MIT OR Apache-2.0) is noted in ATTRIBUTION.md.
-
-## Product name
-SolidCraft everywhere: crates `solidcraft-*`, binaries `solidcraft` and `solidcraft-cli`,
-`.solidcraft` designs, the `solidcraft/N` format tag, `SOLIDCRAFT_*` environment variables,
-settings and recovery folders, the MCP server name, docs, CI and packaging. The old name
-survives only in the explicit compatibility shims listed in `docs/compatibility.md`; don't add
-new uses of it anywhere else. Public docs/web/Flatpak deployments use project Pages
-`/solidcraft/`; do not add permanent old-name Pages aliases.
-
-## Start every session here
-1. Read `plan/STATUS.md` (current milestone, next task), then the task in `plan/execution-plan.md`
-   and the relevant `plan/architecture.md` section.
-2. Kernel and library decisions: `plan/adr/0001-geometry-kernel.md` (what we may depend on, what
-   is rejected for licence reasons).
-3. Follow the autonomous operation protocol (`plan/execution-plan.md` §6). Don't stop to ask
-   unless it lists the decision as the owner's.
-
-`plan/` is gitignored (local only).
-
-## Never crash
-People trust SolidCraft with their designs; a crash loses their work. **This outranks feature work.**
-- **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`,
-  `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`). The exceptions, in the app crate and in
-  `crates/threedx-client` (which deny it instead), have no safe API: the macOS-only
-  `crates/threedx-client/src/macos.rs` (loads the 3Dconnexion driver's client framework at run time
-  and calls through its function pointers), two functions in
-  `apps/solidcraft/src/open_documents.rs` (macOS hands Finder files only to an Objective-C
-  method), the Windows-only `apps/solidcraft/src/native_crash.rs` (the exception filter that
-  records crashes inside native code such as graphics drivers) and the Windows-only
-  `apps/solidcraft/src/native_frame.rs` (the window procedure that answers the resize-border hit
-  test of the window without OS decorations).
-- **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature
-  returns an error ("not supported yet: …"); it never panics.
-- **Input-derived numbers are hostile** (command parameters, design files, control-channel
-  input): `get()` not `[i]`, finite checks, caps on sizes and loop counts.
-- **Third-party kernel calls are guarded:** everything that calls `truck` goes through
-  `solidcraft_kernel::guard`, which turns a panic into `KernelError::Internal`.
-- **Last-resort guard:** `Session::execute` runs every command under `catch_unwind`; an escaped
-  panic restores the design and reports `EngineError::Internal`.
-- **Crash reports:** the desktop app writes every panic and every unclean exit to a local crash folder,
-  with the design and the commands that reproduce it (`solidcraft_engine::crash`, docs/crash-reports.md).
-  When someone says the app crashed, look there first: `solidcraft-cli crashes`, `crashes show <id>`,
-  `crashes replay <id>` (or the `diagnostics.crash_reports` command / MCP `crash_reports` tool).
-- **Prove it:** every crash fix lands with a regression test (see `hostile_params_never_panic`); a
-  crash report's `design.solidcraft` + `replay.json` is the test's starting point.
-- Every production crate root carries
-  `#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]`.
-
-## Non-negotiables
-- **Independent.** SolidCraft is independent. Behaviour is designed from public documentation,
-  general CAD conventions and user feedback. Reference tests use analytic values and open-source
-  tools. Never copy another product's code, icons, artwork, help text, tooltips, templates or
-  materials. File formats come from public specifications.
-- **No commercial CAD products.** Agents must not drive, script, automate or extract data from
-  commercial CAD products (Fusion, SolidWorks, Onshape, …) for this project: no test data,
-  measurements, command lists, ids or files produced with them.
-- **Never read, copy or link GPL/LGPL/AGPL code**: OpenCASCADE, FreeCAD (incl. planegcs),
-  SolveSpace, CadQuery/OCP, LibreCAD, QCAD — don't even read their sources. (`tools/freecad-oracle/`
-  runs FreeCAD as a separate program through its public scripting API to compute reference values;
-  nothing from FreeCAD is linked, vendored or shipped.) The sketch solver and the blend
-  operations are our own.
-- **Assets — absolutely essential.** SolidCraft contains **no iconography, images, fonts or
-  artwork from commercial CAD products — ever.** Every UI icon is drawn in collected code
-  (`assets/icons/ui/source/`, compiled through `crates/ui-egui/src/icons.rs`). Any file asset must be original or openly licensed and **must have a row in ATTRIBUTION.md**
-  (`cargo xtask assets` enforces it). Screenshots of commercial CAD software are never committed.
-  Breaking this rule is the most serious mistake you can make in this repo.
-- **Everything is a command.** User-visible behaviour = a command in `crates/engine/src/cmd/*`
-  (`CommandSpec`: id = our own dotted, lower-case id `<area>.<thing>[.<variant>]` such as
-  `solid.extrude` or `sketch.rectangle.two_point`, never another product's command id; label;
-  toolbar tab and panel; icon; shortcut; params doc; `enabled`; JSON `run`) + tests. The toolbar,
-  dialogs, sketch tools, palette, scripts, CLI and control channel all reach the same commands.
-- **Programmatic calls never open dialogs.** `engine.execute` runs the JSON form; only toolbar
-  clicks (`ui.start`) start interactive tools and dialogs, which then run commands.
-- **Layering** is enforced by `cargo xtask layers`: L0 `geom` → L1 `sketch`, `kernel`, `render`
-  → L2 `doc` → L3 `io` → L4 `engine` → L5 `ui-egui` → apps. Nothing below L5 depends on
-  egui/eframe/winit/wgpu/rfd. **The UI crate is swappable.** Only `crates/kernel` may use `truck`.
-- **The UI is thin**: panels read engine state and act through `app.run(id, params)` /
-  `app.start(id)`. Colours come from `theme::Tokens`.
-- **One set of camera controls**: every page or canvas with a camera (viewport, Render
-  preview, future flat pattern or drawing pages) calls `navigation::handle` with its `NavCaps`
-  (orbit off for flat 2D pages). New canvases must use `navigation::handle`; never hand-roll
-  camera input (a test rejects it).
-- **Rust only.** Units are millimetres and radians internally; Z is up. The one exception is
-  JavaScript the browser requires: the service worker `apps/solidcraft-web/sw.js` (browsers only
-  run service workers as JavaScript) and the small inline scripts in `apps/solidcraft-web/index.html`.
-  Keep them minimal; `cargo xtask web-offline-test` covers the service worker.
-- **Quality gates** before every commit: `cargo xtask ci` (fmt, clippy -D warnings, tests,
-  assets, layers). Commit after every feature arc that builds.
-- **Publishing**: `origin` is github.com/bherbruck/solidcraft. Changes land through **pull requests**:
-  push a branch, open a PR, and let GitHub CI run. Maintainers (and agents working for them) may
-  merge their own PR as soon as CI is green (`gh pr merge --squash`); a trivial fix (docs, typos)
-  may be merged right away. Keep each PR to one topic, rebase or merge `main` into it when it
-  conflicts, and never force-push `main`. Never commit `plan/`, build dirs (`target*/`) or
-  generated reference data; check `git ls-files` before pushing.
-- **Never break wasm**: everything below the apps must build for `wasm32-unknown-unknown`
-  (`cargo xtask wasm`, part of `cargo xtask ci`).
-
-## Showing and following through on changes
-
-- Help reviewers see what is broken or changed. For observable CAD, UI or model behavior,
-  issues and PRs must include actual descriptive screenshots or a short recording from a
-  small reproduction. This includes kernel, geometry, assembly and backend changes whose
-  effects can be shown in the app. Coding agents should run the app and capture this evidence
-  themselves; do not ask a human for evidence the agent can produce. Show the actual failure
-  or result, preferably before and after, with brief reproduction steps, expected/actual
-  behavior and annotations that point out the relevant detail.
-- Flowcharts and Mermaid diagrams cannot substitute for screenshots or recordings of visible
-  behavior. Use diagrams for architectural reasoning when actual screenshots cannot illustrate
-  the point. Changes with no useful observable behavior do not need screenshot or video evidence.
-- Use a small public-safe example and check for private designs, paths, account details or
-  other sensitive content before sharing. Attach media to the issue/PR or link to an accessible
-  recording; do not commit generated screenshots or videos just to provide review evidence.
-- Throughout the work and before handoff, check current upstream commits and the relevant
-  PR's merge status. Keep your branch current with upstream merges, resolve conflicts without
-  discarding others' work, and re-run validation when integration changes the result. Use
-  `git pull --rebase origin main` before pushing as above; never force-push. Report the checked
-  upstream/PR state, any conflicts resolved and the validation performed. If a PR remains open,
-  keep monitoring it while the task is active and make its pending status clear at handoff;
-  do not claim it merged without checking.
-
-## Claim = a draft PR
-- Before working on issue #N, check nobody has it: `gh pr list -R bherbruck/solidcraft --state open --search "#N"`.
-- If none, branch from the latest `origin/main`, `git commit --allow-empty -m "claim: #N"`, push,
-  and open a **draft** PR titled `<summary> (#N)` right away. **The lowest-numbered open PR for an
-  issue wins**; if yours lost, close it. Opening the PR is the claim: the bot assigns you and
-  labels the issue `in progress` (or says on your PR who holds it). Don't claim by editing files.
-- Push work in progress at least daily. A draft with no pushes for 72 hours may be taken over:
-  comment on it first, then open your own claim (you may start from its branch).
-- On a shared build machine, check the load before a big build (`cut -d' ' -f1 /proc/loadavg`)
-  and wait while it is over 24; build with `nice`.
-
-## Design file format
-A change that saves something new in a design adds ONE file, `crates/doc/src/format/pending/<name>.rs`
-(a `//!` note, and `pub fn step` if older designs must be rewritten). Never edit `FORMAT`,
-`JSON_STEPS`, the history in `format.rs`, another change's file or a `v<N>/` folder: the build
-works out the number (the next one while anything is pending), and the release folds pending
-changes into `v<N>/` with `scripts/fold-format-pending.sh`. See CONTRIBUTING.md.
-
-## Application releases
-Development pushes are not application releases. Follow `docs/releasing.md` when asked to
-prepare or ship a release: choose the version from the actual changes, update Cargo.toml and
-Cargo.lock, pass the quality gates, advance `release` without force-pushing, and verify the
-resulting draft and its artifacts. When shipping is authorized, publish that verified draft
-and confirm its tag and downstream deployment. Do not auto-release every push to `main`, infer
-version bumps solely from commit prefixes, overwrite published versions, or push release tags
-before the draft is verified.
-
-## Running and looking at the app
-- `cargo run --release -p solidcraft -- --sample --control PORT` (sample design + control channel).
-  Pick a free port. Without a display, run it under `Xvfb :99` with `DISPLAY=:99`.
-- Drive it with JSON lines on `127.0.0.1:PORT` (see `docs/control-protocol.md`). The first
-  request on a connection carries the launch's token as `"token"`: read it from
-  `~/.local/share/solidcraft/control/PORT.token`, or start the app with
-  `SOLIDCRAFT_CONTROL_TOKEN=$(openssl rand -hex 32)` and send that.
-  - `{"id":1,"method":"engine.execute","params":{"command":"solid.extrude","params":{"distance":20}}}`
-  - `{"id":2,"method":"ui.start","params":{"command":"sketch.create"}}` then `ui.click {x, y}`
-  - `{"id":3,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}` then read the PNG.
-- **For UI work, look at the result** (screenshot, read the PNG). Without a window use
-  `ui.render` or `solidcraft-cli snapshot`.
-- Headless: `solidcraft-cli run script.json --out part.step`, `solidcraft-cli eval design.solidcraft`,
-  `solidcraft-cli snapshot script.json --out shot.png`, `solidcraft-cli commands`.
-- Reference tests: `cargo xtask oracle` replays `tests/oracle/*/recipe.json` and compares with
-  each case's `expected.json` (analytic or FreeCAD values; writes `docs/oracle.md`). Expected
-  values never come from a commercial CAD product.
-- Build with `CARGO_TARGET_DIR=<repo>/target`. Windows: `cargo xwin build --release --target x86_64-pc-windows-msvc -p solidcraft`.
-
-## Roadmap
-`ROADMAP.md` (committed) tracks status, milestones and estimates. Update it whenever a
-milestone task lands. `docs/features.md` (SolidCraft's commands by area, from the registry) and
-`THIRD-PARTY-LICENSES.txt` are regenerated on `main` after each merge by the Generated files
-workflow; never regenerate them in a PR.
-
-## Lists many PRs add to
-Keep them conflict-free (CONTRIBUTING.md, "Lists many changes add to"): message catalogs sorted
-(`cargo xtask lists --fix`), `mod` lines in their sorted group, the language list English first
-then by id, generated files left to `main`, and a design-format change as one new file.
+The agent instructions for this repo live in AGENTS.md; edit that file only.

CONTRIBUTING.md

@@ -15,6 +15,15 @@ Before choosing a task, check the [command inventory](docs/features.md) and
 
 Questions, ideas or want to say what you're working on? Join the [Discord](https://discord.gg/FtU4NQNVDH).
 
+## Kernel work is paused
+
+We're evaluating a new geometry kernel. Until that's decided, please don't open issues, pull
+requests or discussions about kernel work: booleans, fillets, chamfers, shell, offsets, sweeps and
+lofts, threads and holes, STEP/IGES import and export, tessellation, or anything else that changes
+`crates/kernel/`. The pinned issue on the tracker explains it. New ones get the `kernel-paused`
+label (`.github/workflows/kernel-paused.yml`) and a maintainer answers them. Crashes and data loss
+are still taken as issues, and everything outside the kernel carries on as normal.
+
 ## Get it running (about 10 minutes on a fast machine)
 
 You need stable Rust 1.95 or newer (required by egui/eframe 0.36). For the web
@@ -72,7 +81,7 @@ desktop integration and how to distinguish an old executable on `PATH`.
 
 ## How the code is laid out
 
-The [README](README.md#architecture) has the layer table. The short version:
+The [architecture page](docs/architecture.md) has the layer table. The short version:
 
 - `crates/geom`: vectors, planes, meshes, measures.
 - `crates/sketch`: our own constraint solver, plus profile finding.
@@ -148,6 +157,8 @@ the most complete description of the house style.
 A geometry change that changes the robustness goldens re-records them in the same pull request:
 `ROBUSTNESS_GOLDENS_BLESS="why it changed" cargo test --profile ci -p solidcraft-engine --lib robustness_goldens::`
 (see [docs/robustness.md](docs/robustness.md)); CI runs every seed on pull requests that touch geometry.
+[docs/mutation-testing.md](docs/mutation-testing.md) shows how to find kernel behaviour these
+black-box suites miss.
 
 **UI scenarios** drive the real app headless: start a tool, click a plane or a sketch point,
 press keys, then assert on the result.
@@ -175,31 +186,39 @@ no LTO, and debug assertions off (truck has debug-only assertions that reject va
 builds several times faster than `--release`. If a test fails only in a plain debug build, say so
 in the PR. `cargo xtask test` builds the tests with it and then runs every test binary at once
 (`cargo test` runs them one after another); arguments after `--` go to each binary, e.g.
-`cargo xtask test -- shell`. Tests run beside each other on a busy machine, so a test must not
-depend on wall-clock timing.
+`cargo xtask test -- shell`. Set `SOLIDCRAFT_TEST_JOBS` to a positive integer to opt into a
+shared bound on top-level test/side commands for `cargo xtask test` and `cargo xtask ci`.
+For example, `SOLIDCRAFT_TEST_JOBS=2` allows two commands at once; the sequential wasm/doc
+worker consumes one of those slots. Every binary and side check still runs after failures.
+Without the variable the existing concurrency is unchanged. `RUST_TEST_THREADS`,
+`ACTION_MATRIX_JOBS` and Cargo's build-job setting remain independent caller overrides;
+this limit does not choose their values or change test filters, timeouts or baselines.
+Tests run beside each other on a busy machine, so a test must not depend on wall-clock timing.
 
 **Ready pull requests test what they touch.** CI maps changed files to workspace packages and
 runs Clippy, the test build and tests for those and their dependents. The
 [package selector](scripts/ci/affected.py) and [CI workflow](.github/workflows/ci.yml) define
-which changes require native checks; documentation, packaging and bot-script-only PRs can run
-repository checks only. Workspace-wide changes, merge-queue groups, nightly runs and Run
-workflow select the full workspace. A push to `main` reuses a successful merge-queue run for
-the same commit; otherwise it runs the full suite.
+which changes require native checks; documentation, packaging, other-workflow and bot-script-only
+changes run the repository checks only, on pull requests and on `main`. Workspace-wide changes,
+merge-queue groups, nightly runs and Run workflow select the full workspace. A push to `main`
+reuses a successful merge-queue run for the same commit, and runs only the repository checks
+when no code changed since the last push to `main` that passed; otherwise it runs the full
+suite. Doc tests, reference tests and the Windows jobs run on `main` and nightly only.
 
 **CI shards the tests.** One job builds them into a cargo-nextest archive; two shards run on
 pull requests and four during full validation. Every test runs in its own process: don't rely
 on state left by another test.
-Pull requests skip a few heavy tests (one to four minutes each), which run in full validation
+Pull requests skip a few heavy tests (one to twelve minutes each), which run in full validation
 (the merge queue, nightly, manual runs and pushes to `main` not already tested by the queue).
 Check that validation after merging. They are listed in
 `.config/nextest.toml` and the [testing page](docs/book/src/dev/testing.md):
 
 - `solidcraft-engine`: `tests::hostile_params_never_panic`, everything in `tests::robustness` and
-  the seeds of `tests::robustness_goldens` (`seed_00` … `seed_95`; pull requests matching the workflow's geometry paths run all seeds),
+  the seeds of `tests::robustness_goldens` (`seed_00` … `seed_95`; pull requests that change the kernel, truck or the goldens run all but the slowest, `SLOW_SEEDS` in `ci.yml`),
   `pattern_suppress_tests::enclosure_arc_extinction_keeps_a_real_sharp_inner_lip_after_resize_and_reopen`,
   `pattern_suppress_tests::enclosure_datums_follow_wall_height_and_board_depth_with_material_proofs`,
   `cmd::plastic::tests::enclosure_snap_fit_follows_resized_front_wall`, the `atomic_commands` contract tests
-- `solidcraft-kernel`: `tests::boolean_identity_on_tangent_primitives`, and the `boolean_props` property tests
+- `solidcraft-kernel`: `tests::boolean_identity_on_tangent_primitives`, `tspline::tests::hostile_tsplines_never_panic`, and the `boolean_props` property tests
   (these run only in the nightly "Property tests" job: their inputs are random, so main skips them too)
 - `solidcraft-ui-egui` scenarios: `acceptance_sensor_enclosure`
 
@@ -261,6 +280,9 @@ and a fresh CI run:
   after each merge by the Generated files workflow (`cargo xtask licences`, `cargo xtask
   features`). Don't regenerate or edit them in a pull request.
 - **Design format**: one file per change, never an edit to a shared number (above).
+- **New UI strings and attribution rows**: one new file per change, `assets/locales/pending/<slug>.json`
+  and `attribution/pending/<slug>.md`, instead of editing the catalogs or the ATTRIBUTION.md table;
+  `cargo xtask fold-pending` folds them on `main` (see the README in each folder).
 
 ## Sending a change
 
@@ -283,6 +305,11 @@ and a fresh CI run:
 2. Branch from `main` and keep the PR to one topic.
 3. Run `cargo xtask ci` before pushing. It runs fmt, the asset, licence and layer checks,
    clippy (`-D warnings`), then the tests with the wasm build check alongside. A PR has to pass it.
+   Heavy CI runs after review: a pull request gets the formatting and repository checks and a
+   quick compile (`cargo check`) when you push. Once a maintainer has reviewed it they add the
+   `approved-for-ci` label when the PR is ready to merge, which runs the full CI (build, tests,
+   goldens, Clippy); every push after that runs the full set again. Maintainers merge approved
+   PRs in groups by area, so PRs that touch the same code meet a conflict at most once.
 4. Reference the issue (`Fixes #12`). In the PR, say what you tested and how. For geometry work, include the measured numbers (and
    the expected ones).
 
@@ -307,18 +334,25 @@ Changes with no useful observable behavior do not need screenshot or video evide
 small example without private designs or sensitive details; attach the media or link to an
 accessible recording rather than committing generated review artifacts.
 
-Keep checking upstream commits and the relevant PR's merge status throughout the work and
-before handoff. Integrate upstream merges, resolve conflicts without losing others' changes,
-and validate the integrated result. Before pushing, run `git pull --rebase origin main`, re-run
-CI if it brought changes, and push without force. Report the upstream/PR state you checked,
-any conflicts resolved and validation results. While a task remains active, follow an open
-PR through its status changes; at handoff, clearly identify anything still awaiting merge.
+Keep an eye on your PR's status, but don't push to it only to catch up with `main` (no merge of
+`main`, no Update branch button, no rebase for that alone): every push restarts the whole CI
+run for everyone waiting behind it, and `main`'s own run catches what lands in between. When you
+push a change anyway, or GitHub reports a conflict, rebase onto the latest `main` (push your
+branch with `--force-with-lease`) or merge `main` in once, and resolve conflicts without losing
+others' changes. Don't re-run CI on an unchanged commit either: a real failure fails again.
+Re-run only a job that runner trouble cancelled, with "Re-run failed jobs". While a task remains
+active, follow an open PR through its status changes; at handoff, clearly identify anything
+still awaiting merge.
 
 Much of SolidCraft so far was written by AI coding agents (Claude) working in parallel, each
 owning one area, with a human setting direction and reporting bugs. Their working notes are in
 [AGENTS.md](AGENTS.md). Human contributors are just as welcome. Use whatever tools you like, as
 long as the change meets the rules above.
 
+Two quick checks run on every pull request (`.github/workflows/pr-checks.yml`, not required): it
+fails when a lower-numbered open PR by someone else already closes the same issue (the label
+`not-a-duplicate` skips it), or when the description lacks the `Changes a default: no` / `Changes a default: yes — <what>, old behaviour kept behind preference <name>` line (docs-only and bot PRs are exempt).
+
 ## Labels and triage
 
 The triage bot labels every new issue and PR (`.github/workflows/triage.yml`). It only adds labels;
@@ -357,7 +391,21 @@ In order of how much they'd help users:
 3. **Drawings, CAM and mesh tools.** These are out of scope for now (see
    [ROADMAP.md](ROADMAP.md)), but anyone who wants to own one is welcome.
 
+## Updating the generated feature list
+
+After adding or renaming commands, run `cargo xtask features`. The registry is the
+source of truth for `docs/features.md`; do not hand-edit the generated rows.
+The generator sorts commands by ID and omits global and per-section counters,
+so additions to unrelated areas no longer rewrite shared summary lines.
+
+If two branches still conflict in this file (for example, adjacent additions in
+the same area), first resolve the command registry and source conflicts, then run
+`cargo xtask features` again and stage the regenerated file. Do not use Git's
+`union` merge driver: it can silently retain stale or duplicate command rows.
+The generator tests cover stable ordering and additions that leave existing lines
+unchanged. The initial switch to sorted rows is a one-time larger diff.
+
 ## Licence
 
 By contributing you agree that your contribution is licensed as MIT OR Apache-2.0, like the rest
-of SolidCraft. SolidCraft isn't affiliated with Autodesk. Fusion is a trademark of Autodesk, Inc.
+of SolidCraft. SolidCraft isn't affiliated with any CAD vendor; product names are trademarks of their owners (see NOTICE).

Cargo.lock

@@ -590,9 +590,9 @@ checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
 [[package]]
 name = "cadmpeg-codec-freecad"
-version = "0.6.1"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a5257265c2549cf59a8457b3c7aadcc96c95abe20205232553766993a808812"
+checksum = "3c4a8fa61748cbb3ce80838b00a8cebfe553460583941f5aba6e2b97c16b4d37"
 dependencies = [
  "cadmpeg-container",
  "cadmpeg-core",
@@ -601,14 +601,14 @@ dependencies = [
  "serde",
  "serde_json",
  "tempfile",
- "zip 8.6.0",
+ "zip",
 ]
 
 [[package]]
 name = "cadmpeg-codec-rhino"
-version = "0.6.1"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d88b42fb91c7e5af4c75c0433029771f7e3233a0b72ec3d0b2e5ff2c72bed07"
+checksum = "d7af41440d4c1d69e88e612de02cc3c9bad79d03429531e640ac924fef53c6bf"
 dependencies = [
  "cadmpeg-container",
  "cadmpeg-core",
@@ -625,53 +625,53 @@ dependencies = [
 
 [[package]]
 name = "cadmpeg-codec-step"
-version = "0.6.1"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e83a52258c129a683f77fb360ca30af54ae34339625ad890be12621128a5811c"
+checksum = "35e1b6d17cf26b31f59f2edab8ef5c29d2a33216c581fd913f012ad4869bd559"
 dependencies = [
  "base64",
  "cadmpeg-container",
  "cadmpeg-core",
  "cadmpeg-ir",
  "encoding_rs",
+ "serde",
  "serde_json",
  "thiserror 2.0.21",
- "zip 8.6.0",
+ "zip",
 ]
 
 [[package]]
 name = "cadmpeg-container"
-version = "0.6.1"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c110508cd9155e905f52906de505dfd42dc70a0321f5e90b5f68c28ba207686e"
+checksum = "5ab7bcef48ac7480b4917820272d85cd2c9533e17904e15b0e4d22f19a6045bd"
 dependencies = [
  "cadmpeg-core",
  "crc32fast",
  "flate2",
- "zip 8.6.0",
- "zstd 0.14.2",
+ "zip",
 ]
 
 [[package]]
 name = "cadmpeg-core"
-version = "0.6.1"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21b1147e51a74e7c52da5b393a0344597238cdc622fac6443eb2fd526759f6fa"
+checksum = "e86bb7a40521832504bb1f5953a1c706b2c52aad73bf6d84e1b35e5cb0beae3f"
 dependencies = [
  "flate2",
  "memchr",
  "roxmltree",
+ "ruzstd",
  "serde",
  "serde_json",
  "thiserror 2.0.21",
- "zstd 0.14.2",
 ]
 
 [[package]]
 name = "cadmpeg-ir"
-version = "0.6.1"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71ff19f019f013d97e353bb802c5d2e253c2859aaa5422009aa933dc2f2e7dbc"
+checksum = "b570a1a8c579e407a9fd7bb10fa1900f8827f1d578b8fcb4ea2a056b5f323c72"
 dependencies = [
  "base64",
  "cadmpeg-core",
@@ -684,9 +684,9 @@ dependencies = [
 
 [[package]]
 name = "cadmpeg-registry"
-version = "0.6.1"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66046f1a694926707bea8944f861e699964b04c68972708588f97e14ccee3c5d"
+checksum = "b2be23469a9bca0b684f1811118fffb581ebd32ded08e6cc8b0716a41f8c1377"
 dependencies = [
  "cadmpeg-codec-freecad",
  "cadmpeg-codec-rhino",
@@ -813,6 +813,17 @@ dependencies = [
  "rand_core 0.10.1",
 ]
 
+[[package]]
+name = "chardetng"
+version = "0.1.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14b8f0b65b7b08ae3c8187e8d77174de20cb6777864c6b832d8ad365999cf1ea"
+dependencies = [
+ "cfg-if",
+ "encoding_rs",
+ "memchr",
+]
+
 [[package]]
 name = "chrono"
 version = "0.4.45"
@@ -985,6 +996,15 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98b0cc327b5bc766e7fda9c9260cc0fa81b43a8e240440422dff70788e3f9ef1"
+dependencies = [
+ "crossbeam-utils",
+]
+
 [[package]]
 name = "crossbeam-deque"
 version = "0.8.8"
@@ -1164,6 +1184,12 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d8b14ccef22fc6f5a8f4d7d768562a182c04ce9a3b3157b91390b52ddfdf1a76"
 
+[[package]]
+name = "dyn-clone"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
+
 [[package]]
 name = "ecolor"
 version = "0.36.2"
@@ -2254,6 +2280,16 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "keyboard-types"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fbe853b403ae61a04233030ae8a79d94975281ed9770a1f9e246732b534b28d"
+dependencies = [
+ "bitflags 2.13.2",
+ "serde",
+]
+
 [[package]]
 name = "keyring"
 version = "3.6.3"
@@ -2463,6 +2499,24 @@ dependencies = [
  "pxfm",
 ]
 
+[[package]]
+name = "muda"
+version = "0.21.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4340e89c178916e62879c5c36b7f699019369be413e496178a6983ce91b8bc03"
+dependencies = [
+ "crossbeam-channel",
+ "dpi",
+ "keyboard-types",
+ "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
+ "objc2-core-foundation",
+ "objc2-foundation 0.3.2",
+ "png",
+ "thiserror 2.0.21",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "multiversion_no_op"
 version = "1.0.0"
@@ -3503,6 +3557,26 @@ dependencies = [
  "bitflags 2.13.2",
 ]
 
+[[package]]
+name = "ref-cast"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e440fb4e4b4147295338efb76001ab9e4efc0e5839df2c47fc5ac2381d365c3"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92ecd8964f8453721699a1ed72037b0db49ce2f5a5138486ee89bed6f67cdf3a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "regex-syntax"
 version = "0.8.11"
@@ -3712,6 +3786,15 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
 
+[[package]]
+name = "ruzstd"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69e4ce4a039f42bf25920b95667e4d789e98749ab11bbb8d2c2936f788421bb5"
+dependencies = [
+ "twox-hash",
+]
+
 [[package]]
 name = "same-file"
 version = "1.0.6"
@@ -3730,6 +3813,31 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "schemars"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab508826f74a77ca9d5aba6ff19b522583ee3eaf28a19384ff3d0e5835fadf6e"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "schemars_derive",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars_derive"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1c3a92094fa7d61aa124645844facb6b554dfc797136d0f5fd1f890e2bffc69"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde_derive_internals",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "scoped-tls"
 version = "1.0.1"
@@ -3849,6 +3957,17 @@ dependencies = [
  "syn 3.0.6",
 ]
 
+[[package]]
+name = "serde_derive_internals"
+version = "0.30.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f852137cce035d6a4df67ccce505ff6b3e9fd3a10e3e52b24dc71e650bb1a9bd"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "serde_json"
 version = "1.0.151"
@@ -3862,6 +3981,17 @@ dependencies = [
  "zmij",
 ]
 
+[[package]]
+name = "serde_path_to_error"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
+dependencies = [
+ "itoa",
+ "serde",
+ "serde_core",
+]
+
 [[package]]
 name = "serde_repr"
 version = "0.1.21"
@@ -4078,7 +4208,7 @@ dependencies = [
 
 [[package]]
 name = "solidcraft"
-version = "0.16.2"
+version = "0.23.0"
 dependencies = [
  "block2 0.6.2",
  "eframe",
@@ -4088,6 +4218,7 @@ dependencies = [
  "hidapi",
  "keyring",
  "log",
+ "muda",
  "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
@@ -4109,13 +4240,14 @@ dependencies = [
 
 [[package]]
 name = "solidcraft-3dx-client"
-version = "0.16.2"
+version = "0.23.0"
 
 [[package]]
 name = "solidcraft-cli"
-version = "0.16.2"
+version = "0.23.0"
 dependencies = [
  "image",
+ "log",
  "serde_json",
  "solidcraft-engine",
  "solidcraft-gpu",
@@ -4124,7 +4256,7 @@ dependencies = [
 
 [[package]]
 name = "solidcraft-derive"
-version = "0.16.2"
+version = "0.23.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4133,7 +4265,7 @@ dependencies = [
 
 [[package]]
 name = "solidcraft-doc"
-version = "0.16.2"
+version = "0.23.0"
 dependencies = [
  "log",
  "serde",
@@ -4150,11 +4282,13 @@ dependencies = [
 
 [[package]]
 name = "solidcraft-engine"
-version = "0.16.2"
+version = "0.23.0"
 dependencies = [
  "log",
+ "schemars",
  "serde",
  "serde_json",
+ "serde_path_to_error",
  "solidcraft-doc",
  "solidcraft-geom",
  "solidcraft-io",
@@ -4162,12 +4296,13 @@ dependencies = [
  "solidcraft-render",
  "solidcraft-sketch",
  "thiserror 2.0.21",
+ "toml_edit",
  "web-time",
 ]
 
 [[package]]
 name = "solidcraft-geom"
-version = "0.16.2"
+version = "0.23.0"
 dependencies = [
  "serde",
  "serde_json",
@@ -4176,15 +4311,18 @@ dependencies = [
 
 [[package]]
 name = "solidcraft-gpu"
-version = "0.16.2"
+version = "0.23.0"
 dependencies = [
+ "image",
  "log",
  "naga",
  "pollster 0.4.0",
+ "robust",
  "serde",
  "serde_json",
  "solidcraft-engine",
  "solidcraft-geom",
+ "solidcraft-io",
  "solidcraft-kernel",
  "solidcraft-render",
  "thiserror 2.0.21",
@@ -4193,12 +4331,16 @@ dependencies = [
 
 [[package]]
 name = "solidcraft-io"
-version = "0.16.2"
+version = "0.23.0"
 dependencies = [
  "cadmpeg-core",
  "cadmpeg-ir",
  "cadmpeg-registry",
+ "chardetng",
+ "encoding_rs",
+ "gethostname",
  "gltf",
+ "log",
  "quick-xml",
  "rustix 1.1.5",
  "serde",
@@ -4208,12 +4350,12 @@ dependencies = [
  "solidcraft-geom",
  "solidcraft-kernel",
  "thiserror 2.0.21",
- "zip 9.0.4",
+ "zip",
 ]
 
 [[package]]
 name = "solidcraft-kernel"
-version = "0.16.2"
+version = "0.23.0"
 dependencies = [
  "log",
  "proptest",
@@ -4233,7 +4375,7 @@ dependencies = [
 
 [[package]]
 name = "solidcraft-mcp"
-version = "0.16.2"
+version = "0.23.0"
 dependencies = [
  "serde_json",
  "solidcraft-engine",
@@ -4242,7 +4384,7 @@ dependencies = [
 
 [[package]]
 name = "solidcraft-render"
-version = "0.16.2"
+version = "0.23.0"
 dependencies = [
  "image",
  "moxcms",
@@ -4256,7 +4398,7 @@ dependencies = [
 
 [[package]]
 name = "solidcraft-sketch"
-version = "0.16.2"
+version = "0.23.0"
 dependencies = [
  "serde",
  "serde_json",
@@ -4267,11 +4409,14 @@ dependencies = [
 
 [[package]]
 name = "solidcraft-space-mouse"
-version = "0.16.2"
+version = "0.23.0"
+dependencies = [
+ "serde",
+]
 
 [[package]]
 name = "solidcraft-ui-egui"
-version = "0.16.2"
+version = "0.23.0"
 dependencies = [
  "arboard",
  "egui",
@@ -4279,24 +4424,28 @@ dependencies = [
  "image",
  "log",
  "minisign-verify",
+ "nix 0.31.3",
  "pollster 0.4.0",
+ "proc-macro2",
  "semver",
  "serde",
  "serde_json",
  "sha2 0.10.9",
  "solidcraft-engine",
  "solidcraft-gpu",
+ "solidcraft-space-mouse",
+ "syn 2.0.119",
  "tiny-skia",
  "toml",
  "ttf-parser",
  "web-time",
  "winreg",
- "zip 9.0.4",
+ "zip",
 ]
 
 [[package]]
 name = "solidcraft-web"
-version = "0.16.2"
+version = "0.23.0"
 dependencies = [
  "eframe",
  "egui",
@@ -4305,6 +4454,7 @@ dependencies = [
  "serde_json",
  "solidcraft-engine",
  "solidcraft-ui-egui",
+ "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
@@ -4551,6 +4701,7 @@ dependencies = [
  "indexmap",
  "toml_datetime",
  "toml_parser",
+ "toml_writer",
  "winnow",
 ]
 
@@ -4745,6 +4896,12 @@ version = "0.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d2df906b07856748fa3f6e0ad0cbaa047052d4a7dd609e231c4f72cee8c36f31"
 
+[[package]]
+name = "twox-hash"
+version = "2.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86a801b3cea342a06d468c8710662aa29e5e05e4f5c0d62f00bbb7f2ad7941c2"
+
 [[package]]
 name = "type-map"
 version = "0.5.1"
@@ -5826,10 +5983,12 @@ checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"
 
 [[package]]
 name = "xtask"
-version = "0.16.2"
+version = "0.23.0"
 dependencies = [
+ "proc-macro2",
  "serde_json",
  "sha2 0.10.9",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -6117,20 +6276,6 @@ dependencies = [
  "syn 3.0.6",
 ]
 
-[[package]]
-name = "zip"
-version = "8.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
-dependencies = [
- "crc32fast",
- "flate2",
- "indexmap",
- "memchr",
- "typed-path",
- "zstd 0.13.3",
-]
-
 [[package]]
 name = "zip"
 version = "9.0.4"
@@ -6170,52 +6315,6 @@ dependencies = [
  "simd-adler32",
 ]
 
-[[package]]
-name = "zstd"
-version = "0.13.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
-dependencies = [
- "zstd-safe 7.3.0",
-]
-
-[[package]]
-name = "zstd"
-version = "0.14.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "057cfd910cfac363a0ada849592624b4c9ff2e10bef504c3433810d78ed96f93"
-dependencies = [
- "zstd-safe 8.1.0",
-]
-
-[[package]]
-name = "zstd-safe"
-version = "7.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64d80649ab6db9d9f6f9c80a40becd948eda4714a0a5ac8c4d157a32231c7882"
-dependencies = [
- "zstd-sys",
-]
-
-[[package]]
-name = "zstd-safe"
-version = "8.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bdd44c6a7284e91f3717755b24315a302edd9153a01f753c3cba3d765e8eafac"
-dependencies = [
- "zstd-sys",
-]
-
-[[package]]
-name = "zstd-sys"
-version = "2.1.1+zstd.1.5.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aeec9eaf2dffbbd09201e23bd0ffcbaa33bb8e9266a10734fd7ed90a85eca078"
-dependencies = [
- "cc",
- "pkg-config",
-]
-
 [[package]]
 name = "zune-core"
 version = "0.5.3"

Cargo.toml

@@ -5,7 +5,7 @@ members = ["crates/*", "apps/*", "xtask"]
 exclude = ["vendor"]
 
 [workspace.package]
-version = "0.16.2"
+version = "0.23.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -13,6 +13,7 @@ authors = ["SolidCraft contributors"]
 repository = "https://github.com/bherbruck/solidcraft"
 
 [workspace.dependencies]
+robust = "1.2"
 # internal
 solidcraft-geom = { path = "crates/geom" }
 solidcraft-sketch = { path = "crates/sketch" }
@@ -36,6 +37,9 @@ proc-macro2 = "1"
 quote = "1"
 syn = { version = "2", features = ["full"] }
 serde_json = { version = "1", features = ["float_roundtrip"] }
+# command parameter and result schemas
+schemars = "1.2"
+serde_path_to_error = "0.1"
 log = "0.4"
 sha2 = "0.10"
 moxcms = { version = "0.8.1", default-features = false, features = ["extended_range"] }
@@ -55,21 +59,32 @@ rayon = "1.12"
 # packages (3MF)
 zip = { version = "9", default-features = false, features = ["deflate"] }
 quick-xml = "0.41"
+# STEP text in a legacy encoding (GBK, Shift_JIS, …) instead of Part 21 escapes (#2344): detect
+# and decode it. Both MIT OR Apache-2.0 (encoding_rs adds BSD-3-Clause data); encoding_rs is
+# already in the tree through cadmpeg-codec-step.
+chardetng = "0.1"
+encoding_rs = "0.8"
 # glTF 2.0 import (MIT OR Apache-2.0): the document model and GLB container only; buffers are
 # read by crates/io itself, so no image decoding or file access comes with it.
 gltf = { version = "1.4", default-features = false, features = ["names"] }
+# The computer's name in a design's "open elsewhere" lock file (MIT OR Apache-2.0; already in the
+# tree through x11rb).
+gethostname = "1"
 
-# FreeCAD and Rhino import (Apache-2.0, pure Rust apart from zstd; native builds only).
+# FreeCAD and Rhino import (Apache-2.0, pure Rust; native and browser builds).
 # Pinned: its IR and codec APIs change between minor versions. Open formats only: no default
 # features, so cadmpeg's codecs for commercial formats (f3d, sldprt, inventor, catia, creo, nx)
 # and its ShapeManager/ACIS `sat` codec are not compiled in. `step` is the writer we restate through.
-cadmpeg-core = "=0.6.1"
-cadmpeg-ir = "=0.6.1"
-cadmpeg-registry = { version = "=0.6.1", default-features = false, features = ["fcstd", "rhino", "step"] }
+cadmpeg-core = "=0.6.3"
+cadmpeg-ir = "=0.6.3"
+cadmpeg-registry = { version = "=0.6.3", default-features = false, features = ["fcstd", "rhino", "step"] }
 
 # fonts (sketch text outlines; MIT OR Apache-2.0, pure Rust)
 ttf-parser = { version = "0.25", default-features = false, features = ["std"] }
 
+# Ends a process group with the system call (MIT; already in the tree through zip).
+nix = { version = "0.31", default-features = false, features = ["signal"] }
+
 # images
 image = { version = "0.25", default-features = false, features = ["png", "hdr"] }
 png = "0.18.1"
@@ -123,6 +138,9 @@ incremental = false
 
 [profile.ci.package."*"]
 opt-level = 2
+# No line tables for dependencies: they were over a third of the test archive every CI shard
+# downloads. Our own crates keep theirs, so a backtrace still names file:line in them.
+debug = false
 
 [profile.release]
 opt-level = 3
@@ -142,3 +160,9 @@ matext4cgmath = { path = "vendor/matext4cgmath" }
 
 # Keep OpenGL pipelines, resolve textures and CAD callbacks at the same safe sample count.
 egui-wgpu = { path = "vendor/egui-wgpu" }
+
+# Mutation testing (cargo-mutants, docs/mutation-testing.md): the ci profile with incremental
+# builds, since every mutant rebuilds the crates above the one it changes.
+[profile.mutants]
+inherits = "ci"
+incremental = true

NOTICE

@@ -29,5 +29,8 @@ for sketch text, BIZ UDPGothic for web Japanese display) are licensed under SIL
 per-file list is in ATTRIBUTION.md.
 
 SolidCraft is an independent project and is not affiliated with, sponsored by or endorsed by
-Autodesk, Inc. Autodesk and Fusion are trademarks of Autodesk, Inc.; they are used here only to
-describe compatibility goals.
+Autodesk, Dassault Systèmes, PTC, Siemens, Blender or any other CAD vendor. Fusion, AutoCAD,
+Inventor, Alias and Tinkercad are trademarks of Autodesk, Inc.; SolidWorks is a trademark of
+Dassault Systèmes; Onshape and Creo are trademarks of PTC; Blender is a trademark of the Blender
+Foundation. Product names appear only to describe compatibility, such as the mouse navigation
+presets in Preferences › Navigation and file formats from public specifications.

README.md

@@ -26,6 +26,7 @@
   <a href="https://solidcraft.io/download">Download</a> ·
   <a href="https://solidcraft.io/app">Try it in the browser</a> ·
   <a href="https://docs.solidcraft.io/">Documentation</a> ·
+  <a href="https://www.blacksmith.sh"><img src="https://img.shields.io/badge/CI-Blacksmith-000000?logo=githubactions&logoColor=white" alt="CI powered by Blacksmith" /></a>
   <a href="https://discord.gg/FtU4NQNVDH">Discord</a> ·
   <a href="https://github.com/bherbruck/solidcore">SolidCore</a>
 </p>
@@ -40,36 +41,96 @@
   <a href="https://github.com/tangency-labs/solidcraft/stargazers"><img src="https://img.shields.io/github/stars/tangency-labs/solidcraft?style=flat" alt="Stars" /></a>
 </p>
 
-![SolidCraft 0.8: model a Raspberry Pi 4 case from an empty design: a sketch dimensioned with parameters, extrude, fillets and shell, a rim rounded in one pick, standoffs patterned on the board's mounting holes, port cut-outs, vent slots, "Pi 4" engraved in a font, a PETG material with its mass in Properties, and a height change in Parameters](docs/screenshots/demo-0.8.gif)
+<p align="center">
+  <a href="https://trendshift.io/repositories/296178?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-296178" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/296178/daily" alt="tangency-labs%2Fsolidcraft | Trendshift" width="250" height="55"/></a>
+  <a href="https://trendshift.io/repositories/296178?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-296178" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/296178/daily?language=Rust" alt="tangency-labs%2Fsolidcraft | Trendshift (Rust)" width="250" height="55"/></a>
+</p>
 
-*A Raspberry Pi 4 case from an empty design: a sketch dimensioned with the board's parameters, extrude, fillet, shell, the rim rounded in one pick, an M2.5 standoff patterned on the 58 × 49 mm hole rectangle, port cut-outs, vent slots, "Pi 4" engraved in DejaVu Sans Bold and a PETG material defined in the design, with its mass in Properties, then height 24 → 32 mm in Parameters and it all rebuilds. 9× playback. [Full video](https://github.com/tangency-labs/solidcraft/raw/refs/heads/main/docs/screenshots/demo-0.8.mp4), recorded with the [demo script](examples/demo/record_ui.sh).*
+![SolidCraft: model a Raspberry Pi 4 case from an empty design: a sketch dimensioned with parameters, extrude, fillets and shell, a rim rounded in one pick, standoffs patterned on the board's mounting holes, port cut-outs, vent slots, "Pi 4" engraved in a font, a PETG material with its mass in Properties, and a height change in Parameters](docs/screenshots/demo.gif)
+
+*A Raspberry Pi 4 case from an empty design: a sketch dimensioned with the board's parameters, extrude, fillet, shell, the rim rounded in one pick, an M2.5 standoff patterned on the 58 × 49 mm hole rectangle, port cut-outs, vent slots, "Pi 4" engraved in DejaVu Sans Bold and a PETG material defined in the design, with its mass in Properties, then height 24 → 32 mm in Parameters and it all rebuilds. 6× playback with the idle pauses cut. [Full video](https://github.com/tangency-labs/solidcraft/raw/refs/heads/main/docs/screenshots/demo.mp4), recorded with the [demo script](examples/demo/record_ui.sh).*
 
 ## Download
 
-- **Windows:** download and run the [installer][windows-msi].
-  Also for [ARM64][windows-arm64-msi] and [32-bit][windows-x86-msi] PCs, or as a
-  [portable zip][windows-portable] that runs without installing.
-  With [WinGet](https://learn.microsoft.com/windows/package-manager/winget/):
-  `winget install bherbruck.SolidCraft`.
-- **macOS:** open the [disk image][macos-dmg] and drag SolidCraft into Applications
-  (Apple silicon and Intel).
-- **Linux:** download the [AppImage][linux-appimage], allow it to run as a program and open it.
-  Or install the [.deb][linux-deb] (Ubuntu, Debian, Mint) or [.rpm][linux-rpm] (Fedora,
-  openSUSE), or use [Flatpak](https://docs.solidcraft.io/guide/getting-started.html#linux-flatpak).
-  With Snap: `sudo snap install solidcraft` ([Snap Store][snap-store], or the [.snap file][linux-snap]).
-  For ARM64: [AppImage][linux-arm64-appimage], [.deb][linux-arm64-deb], [.rpm][linux-arm64-rpm].
+- **Windows:** the [installer][windows-msi], or `winget install bherbruck.SolidCraft`.
+- **macOS:** the [disk image][macos-dmg] (Apple silicon and Intel).
+- **Linux:** the [AppImage][linux-appimage], or `sudo snap install solidcraft` ([Snap Store][snap-store]).
 - **Web:** [try it in your browser][web-app], no install.
 
-The downloads aren't signed yet. On Windows, if SmartScreen warns you, choose **More info**, then
-**Run anyway**. On macOS, the first time, right-click SolidCraft in Applications and choose **Open**.
+ARM64 and 32-bit builds, portable zip, .deb, .rpm, Flatpak and the other packages are on the
+[downloads page](docs/downloads.md). The downloads aren't signed yet: on Windows choose
+**More info**, then **Run anyway** in SmartScreen; on macOS right-click SolidCraft and choose **Open**
+the first time. On SolidCraft 0.11 to 0.14, download once by hand; see
+[updating](https://docs.solidcraft.io/guide/updates.html#updating-from-011-to-014).
 
-**On SolidCraft 0.11 to 0.14?** Its **Update now** can't install 0.15.0 or later, because the
-releases moved to a new address. Download the new version once from the links above; after that,
-updating from inside SolidCraft works again ([details](https://docs.solidcraft.io/guide/updates.html#updating-from-011-to-014)).
+## What works
 
-Older versions, checksums and other formats are on the [releases page](https://github.com/tangency-labs/solidcraft/releases).
-Install details, upgrading from earlier builds and building from source are in
-[Getting started](https://docs.solidcraft.io/guide/getting-started.html).
+Early but usable for simple parts: 75 of 76 public reference parts match their analytic or
+FreeCAD-computed volume, area, centre of mass and bounding box ([oracle](docs/oracle.md)); the
+other is a tracked bug.
+
+- **Sketches and constraints:** lines, arcs, splines, text and more, solved by our own constraint solver, with parameter-driven dimensions.
+- **Features:** extrude, revolve, sweep, loft, fillet, chamfer, shell, draft, holes, threads, patterns, mirror, split and combine on an editable parametric timeline.
+- **Parameters and configurations** with unit-aware expressions.
+- **Assemblies** with joints, motion studies, contact sets, interference and mass properties.
+- **Sheet metal** with flanges, hems, fold/unfold and flat patterns, and plastic enclosure features.
+- **Files:** STEP, IGES, 3MF, STL, OBJ and glTF in and out where supported, URDF export, `.solidcraft` designs.
+- **Desktop app, browser app, headless CLI and MCP server**, all running the same commands.
+
+The full list is in [docs/capabilities.md](docs/capabilities.md) and [docs/features.md](docs/features.md);
+status and plans are in [ROADMAP.md](ROADMAP.md). See also [what people built](docs/showcase.md),
+[3D mouse support](docs/3d-mouse.md) and the [architecture](docs/architecture.md).
+
+## Build from source
+
+```sh
+cargo run --release -p solidcraft -- --sample      # desktop app with a sample part
+cargo run --release -p solidcraft-cli -- commands  # the command registry
+cargo run --release -p solidcraft-cli -- run examples/bracket.json --out bracket.step
+cargo xtask ci                                     # fmt, clippy, tests, icons, assets, layers, wasm
+```
+
+More commands, the Windows cross-build and the browser build are in [docs/building.md](docs/building.md).
+
+## AI agents (MCP)
+
+`solidcraft-cli mcp` is a [Model Context Protocol](https://modelcontextprotocol.io) server. Headless it
+runs its own design session, or with `--connect` it drives the running app so you can watch.
+Claude Code: `claude mcp add solidcraft -- solidcraft-cli mcp`. Tools, access rules and an
+example session: [docs/mcp.md](docs/mcp.md).
+
+## Scripts
+
+A script is a JSON list of the same commands the UI runs, executed with `solidcraft-cli run`.
+Format and example: [docs/scripts.md](docs/scripts.md). Pages can also be driven through the
+[browser command API](docs/browser-api.md).
+
+## Contributing
+
+Help is welcome. [CONTRIBUTING.md](CONTRIBUTING.md) covers how to build and test, the code map,
+the clean-room and licence rules, and where help is wanted most. Open work is in
+[GitHub issues](https://github.com/tangency-labs/solidcraft/issues); chat is on
+[Discord](https://discord.gg/FtU4NQNVDH).
+
+## Sponsors
+
+[![CI powered by Blacksmith](docs/sponsors/blacksmith-ci-powered.png)](https://www.blacksmith.sh)
+
+SolidCraft's continuous integration runs on [Blacksmith](https://www.blacksmith.sh), which
+sponsors its CI minutes.
+
+## Licence
+
+MIT OR Apache-2.0, at your option. Developed under the
+[clean-room contribution rules](AGENTS.md); third-party code and assets retain their
+documented licences and attribution.
+
+SolidCraft is independent. Behaviour is designed from public documentation, general CAD
+conventions and user feedback. Reference tests use analytic values and open-source tools.
+SolidCraft is not affiliated with, sponsored by or endorsed by Autodesk, Dassault Systèmes, PTC,
+Siemens or any other CAD vendor. Fusion, AutoCAD, Inventor, SolidWorks, Onshape, Creo, Blender and
+Tinkercad are trademarks of their respective owners, named only to describe compatibility
+(see [NOTICE](NOTICE)).
 
 [badge-windows]: https://img.shields.io/badge/Windows-Download-0078D6?style=for-the-badge&logo=data%3Aimage%2Fsvg%2Bxml%3Bbase64%2CPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAyNCAyNCIgZmlsbD0id2hpdGUiPjxwYXRoIGQ9Ik0yIDJoOS41djkuNUgyek0xMi41IDJIMjJ2OS41aC05LjV6TTIgMTIuNWg5LjVWMjJIMnpNMTIuNSAxMi41SDIyVjIyaC05LjV6Ii8%2BPC9zdmc%2B
 [badge-macos]: https://img.shields.io/badge/macOS-Download-333333?style=for-the-badge&logo=apple&logoColor=white
@@ -77,254 +138,7 @@ Install details, upgrading from earlier builds and building from source are in
 [badge-snap]: https://img.shields.io/badge/Snap-Snap_Store-82BEA0?style=for-the-badge&logo=snapcraft&logoColor=white
 [badge-web]: https://img.shields.io/badge/Web-Try_in_browser-2EA44F?style=for-the-badge&logo=data%3Aimage%2Fsvg%2Bxml%3Bbase64%2CPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAyNCAyNCIgZmlsbD0ibm9uZSIgc3Ryb2tlPSJ3aGl0ZSIgc3Ryb2tlLXdpZHRoPSIyIj48Y2lyY2xlIGN4PSIxMiIgY3k9IjEyIiByPSIxMCIvPjxwYXRoIGQ9Ik0yIDEyaDIwTTEyIDJhMTUgMTUgMCAwIDEgMCAyME0xMiAyYTE1IDE1IDAgMCAwIDAgMjAiLz48L3N2Zz4%3D
 [windows-msi]: https://github.com/tangency-labs/solidcraft/releases/latest/download/solidcraft-windows-x64.msi
-[windows-arm64-msi]: https://github.com/tangency-labs/solidcraft/releases/latest/download/solidcraft-windows-arm64.msi
-[windows-x86-msi]: https://github.com/tangency-labs/solidcraft/releases/latest/download/solidcraft-windows-x86.msi
-[windows-portable]: https://github.com/tangency-labs/solidcraft/releases/latest/download/solidcraft-windows-x64-portable.zip
 [macos-dmg]: https://github.com/tangency-labs/solidcraft/releases/latest/download/solidcraft-macos-universal.dmg
 [linux-appimage]: https://github.com/tangency-labs/solidcraft/releases/latest/download/solidcraft-linux-x86_64.AppImage
-[linux-deb]: https://github.com/tangency-labs/solidcraft/releases/latest/download/solidcraft-linux-x86_64.deb
-[linux-rpm]: https://github.com/tangency-labs/solidcraft/releases/latest/download/solidcraft-linux-x86_64.rpm
-[linux-arm64-appimage]: https://github.com/tangency-labs/solidcraft/releases/latest/download/solidcraft-linux-aarch64.AppImage
-[linux-arm64-deb]: https://github.com/tangency-labs/solidcraft/releases/latest/download/solidcraft-linux-aarch64.deb
-[linux-arm64-rpm]: https://github.com/tangency-labs/solidcraft/releases/latest/download/solidcraft-linux-aarch64.rpm
-[linux-snap]: https://github.com/tangency-labs/solidcraft/releases/latest/download/solidcraft-linux-x86_64.snap
 [snap-store]: https://snapcraft.io/solidcraft
 [web-app]: https://solidcraft.io/app
-
-**Documentation:** the [SolidCraft book](https://docs.solidcraft.io/) (user guide,
-developer guide and command reference; sources in [docs/book](docs/book)).
-
-**Community:** chat with users and contributors on [Discord](https://discord.gg/FtU4NQNVDH).
-
-**Status: early but usable for simple parts.** 75 of 76 public reference parts
-match their analytic or FreeCAD-computed volume, area, centre of mass and bounding box
-([docs/oracle.md](docs/oracle.md)); the other is a tracked bug.
-These checks do not establish complete geometric or workflow equivalence. The commands SolidCraft has
-are listed by area in [docs/features.md](docs/features.md); status and plans are in [ROADMAP.md](ROADMAP.md).
-Open work and known bugs are in [GitHub issues](https://github.com/tangency-labs/solidcraft/issues),
-and help is welcome: see [CONTRIBUTING.md](CONTRIBUTING.md).
-
-## Built with SolidCraft
-
-<a href="https://github.com/0xlillith/solidcraft-rover"><img src="docs/screenshots/rover-build.gif" alt="SELENE, a scientific rover by 0xlillith, assembling itself as the timeline plays through its 3,323 steps in SolidCraft: tub, wheels, electronics, suspension, sampling arm, solar wings, dish and camera turret" loading="lazy"></a>
-
-*SELENE, a scientific rover built entirely through SolidCraft's MCP server by
-[@0xlillith](https://github.com/0xlillith/solidcraft-rover): 3,323 editable timeline steps that
-rebuild with no errors, replayed here at 2× speed.
-[Full video](https://github.com/tangency-labs/solidcraft/raw/refs/heads/main/docs/screenshots/rover-build.mp4)
-· [download the editable model](https://github.com/0xlillith/solidcraft-rover/releases/tag/v1.0.0).*
-
-## What works
-
-- **Current-view DXF export** from File → Export Current View as DXF, with hidden edges
-  omitted or dashed, shown body placements and the current camera. See [view DXF](docs/view-dxf.md).
-
-- **Sketches** on origin planes, offset planes or planar faces: lines, rectangles, circles,
-  arcs, polygons, slots, ellipses, fit/control splines, conics and text; construction geometry,
-  projection, trimming, fillets and chamfers, including corners at the origin.
-  New face attachments retain supported construction identities and chosen occurrences;
-  missing sources expose an explicit plane repair workflow. See [face attachments](docs/face-attachments.md).
-  Explicitly closed fit splines and closed associative offsets use periodic C2 interpolation.
-  Supported convex line-and-arc offsets retain their identity when an inset consumes corner
-  arcs, and linked extrusions follow the current boundary. Breaking the association freezes
-  the boundary and keeps existing extrusions usable.
-  Curve drawing and picking adapt together to zoom and display scale, including small circles
-  at Fit and sketches in placed components.
-- **Constraints and dimensions** solved by our own solver. Points the constraints fix relative
-  to known geometry are placed exactly by construction (loci intersections and rigid-cluster
-  decomposition, after Owen 1991 and Fudos–Hoffmann 1997); Levenberg–Marquardt solves the rest,
-  and the rank of its Jacobian gives the remaining degrees of freedom. Constraints: coincident,
-  point on curve, horizontal/vertical, parallel, perpendicular, tangent, curvature (G2), equal,
-  concentric, collinear, midpoint, symmetry, fix; linear, aligned, horizontal, vertical,
-  point-to-line, radius, diameter, angle, arc sweep, arc length and slot length dimensions driven
-  by parameters. Over-constraining edits are rejected; fully constrained geometry turns black.
-  Dragging solves the sketch every frame and rebuilds the model once, when the drag ends.
-  Select a line or its two endpoints, type its dimension and press Enter to commit one undo
-  step; with Sketch Dimension it's D, click, type, Enter. Fit keeps sketch geometry clear of the palette and navigation controls.
-- **Profiles** found automatically, including regions split by lines and holes inside outlines.
-  Newly captured complete adaptive boundaries retain their outer and hole source identities
-  when spline span counts change. Partial or ambiguous boundaries do not qualify.
-- **Features** on a parametric timeline: extrude, revolve, sweep, loft, fillet/chamfer,
-  shell, draft, holes, threads, patterns, mirror, split, combine, move and construction geometry.
-  The timeline rebuilds incrementally; features can be edited, suppressed, renamed, reordered
-  and deleted. Supported geometry and current limitations are described in [ROADMAP.md](ROADMAP.md).
-  New revolves preserve symmetric and two-sided angular placement across reversed axes;
-  older designs retain their saved convention when reopened or edited.
-- **Parameters and configurations** with unit-aware expressions (`2 * width + 5 mm`,
-  `angle / 2`), ordered rules, feature suppression and per-row body materials/appearances.
-- **Assemblies** with nested components and occurrences, joints, motion studies, contact sets,
-  interference and material-aware mass properties. Recorded body transfers preserve modelling
-  history and world placement; 3D sketch wires retain their coordinate frames through edits.
-- **Sheet metal** with flanges, hems, fold/unfold/refold, material cutouts, flat patterns,
-  retained shallow prismatic pockets, exact line/arc/circle DXF outlines and bend tables;
-  plastic enclosure features and rules. Pocket depth and side survive unfold/refold and appear
-  separately from through-hole outlines in the flat preview and DXF.
-- **Files**: design containers (`.solidcraft`) with lossless binary mesh payloads;
-  plain JSON remains supported for opening, Save As and export. Desktop Open can show a saved
-  provisional picture from warm geometry caches while rebuilding before editing; caches never
-  replace the parametric design. Export to STEP (AP242 with body names, colours and
-  components as assemblies; revolved faces as native planes, cylinders, cones, spheres and tori),
-  IGES 5.3 (manifold solid B-reps with names and colours), 3MF, STL (binary/ASCII) and OBJ, and
-  assemblies with joints as URDF for robot simulators (docs/urdf.md);
-  3MF, STL, OBJ and glTF 2.0 (`.glb`/`.gltf`, its node tree as components and its materials as
-  appearances) import as mesh bodies (they render, measure, move and export; solid features
-  need B-rep bodies). The `mesh.convert` command reconstructs supported closed constant-section parts
-  as parametric solids with planar and circular cylindrical faces;
-  STEP import (AP203/AP214/AP242 solids, assemblies, units, names, colours) and IGES import
-  (manifold solid B-reps, or trimmed and bounded surfaces sewn into solids) as a base feature
-  that later features build on — open a `.step`/`.stp`/`.igs`/`.iges` file, insert one into a
-  design, or drop it on the window ([docs/step-import.md](docs/step-import.md)); FreeCAD
-  `.FCStd` and Rhino `.3dm` solids import the same way through
-  [cadmpeg](https://github.com/cadmpeg/cadmpeg) in the desktop app and CLI.
-- **Render:** opaque surfaces can use metal fraction, roughness and dielectric IOR in the
-  integrated product viewport and CPU preview PNGs. Existing simple colors remain supported.
-  Fixed direct lighting is a preview; HDRI, refraction and texture maps are not implemented.
-  See [opaque surfaces](docs/render-opaque-pbr.md).
-- **Display meshes** from our own tessellation planner: each face becomes a plan of (u, v)
-  points and triangles that shares its edge nodes with its neighbours, so the mesh is watertight.
-  Facets follow the chord tolerance, the facet angle and a longest side, with cells at most 2:1
-  along straight directions. Box-bounded and four-cornered faces mesh as structured grids.
-  Trimmed faces are cut into four-sided patches: squares around holes, butterflies in round
-  faces, motorcycle traces from concave corners (after Lyon et al. 2019). Each patch then meshes
-  as a Coons grid. Intersection edges are evaluated by Newton on both surfaces. A compute shader
-  evaluates the plans for the whole scene in one dispatch, with a CPU fallback when the GPU
-  can't build it. Planning and evaluating the 78 reference bodies takes about 65 ms, 50–65×
-  faster than the previous mesher.
-- **Desktop app** (egui + wgpu): toolbar with workspace tabs, browser, timeline, 3D viewport with
-  axis view and navigation bar, sketch tools, feature dialogs, command palette, and a JSON-lines
-  control channel so agents and tests can drive it.
-  Feature errors and Help can open an editable **Create Issue** draft with relevant context
-  and an optional reviewed screenshot; opening GitHub does not submit the report.
-- **Headless CLI** `solidcraft-cli`: run command scripts, measure (volume, area, centre of mass,
-  face/edge/vertex counts), export, render PNG snapshots and replay reference recipes.
-- **MCP server** `solidcraft-cli mcp`: AI agents model, measure and look at parts headless or
-  in the running app (see below).
-
-## Build and run
-
-```sh
-cargo run --release -p solidcraft -- --sample          # desktop app with a sample part
-cargo run --release -p solidcraft-cli -- commands      # the command registry
-cargo run --release -p solidcraft-cli -- run examples/bracket.json --out bracket.step
-cargo run --release -p solidcraft-cli -- snapshot examples/bracket.json --out bracket.png
-cargo run --release -p solidcraft-cli -- render examples/render-studio.json --out product.png
-cargo run --release -p solidcraft -- part.step          # open a STEP file as a new design
-cargo run --release -p solidcraft-cli -- eval part.step # measure an imported STEP file
-cargo xtask ci                                          # fmt, clippy, tests, icons, assets, layers, wasm
-```
-
-UI artwork changes follow the [icon specification](assets/icons/ui/STYLE_GUIDE.md).
-The [included review tool](assets/icons/ui/README.md) discovers new icons and keeps
-unaccepted artwork Open; run `cargo xtask icons` to check the collection.
-
-Windows builds: `cargo xwin build --release --target x86_64-pc-windows-msvc -p solidcraft`.
-
-On Windows, macOS and Linux, SolidCraft detects a connected 3D mouse through its HID multi-axis
-controller interface: a 3Dconnexion SpaceNavigator or SpaceMouse, or a homemade device that
-declares itself one. Move the cap to pan and zoom, and tilt or twist it to rotate the 3D view.
-While editing a sketch, the cap pans and zooms without changing the sketch view. The Navigation
-page in Preferences has an on/off switch, a speed control and, for each of the cap's six axes, an
-invert switch and a speed for the 3D mouse. The web app reads
-it too, through the browser; Firefox needs a 3DxWare setting first (see
-[Getting started › 3D mouse in the browser](docs/book/src/guide/getting-started.md#3d-mouse-in-the-browser)).
-
-With 3DxWare on Windows, SolidCraft follows 3DxWare's profile for it when there is one, and
-3DxWare's object mode (tilt to roll, twist to spin) until there is. The mouse-wheel turns that
-3DxWare makes from the cap's motion are ignored, so the view doesn't zoom in steps as the cap tilts.
-
-On Linux SolidCraft reads the 3D mouse through `spacenavd` when that daemon runs (its socket
-`/var/run/spnav.sock`), so what you set in `spnavcfg` (swapped or inverted axes, sensitivity, dead
-zones) applies as it does in other programs, and no udev rule is needed. With nothing set there,
-the motion is the same as without the daemon. Without `spacenavd`, SolidCraft reads `/dev/hidrawN`
-directly, so the logged-in user needs access to the device. A udev rule that adds the `uaccess`
-tag does that, for example
-`/etc/udev/rules.d/70-3d-mouse.rules` for USB devices with 3Dconnexion's vendor id, and for its
-Bluetooth ones (where `idVendor` isn't set, so the HID id is matched instead):
-
-```
-SUBSYSTEM=="hidraw", ATTRS{idVendor}=="256f", TAG+="uaccess"
-SUBSYSTEM=="hidraw", KERNELS=="0005:256F:*", TAG+="uaccess"
-```
-
-Older SpaceNavigators use Logitech's vendor id `046d`, so add a rule with their product id (see
-`lsusb`) instead of matching every Logitech device. A homemade device needs a rule with its own
-vendor and product id. Reload with `sudo udevadm control --reload && sudo udevadm trigger`, then
-replug the device. The Flatpak sandbox does not expose hidraw devices, so the 3D mouse only works
-with native builds there for now.
-
-SolidCraft finds the axes from the device's report descriptor, so it doesn't matter how a device
-lays them out: translation and rotation in separate reports (3Dconnexion's wired devices), all six
-in one (its wireless ones and most homemade devices), after the buttons, or narrower than 16 bits.
-Each axis is scaled from the range the descriptor declares.
-
-On macOS SolidCraft talks to the 3Dconnexion driver (3DxWare) when it is installed, through the
-driver's client API (`crates/threedx-client`; the framework is loaded at run time, never bundled).
-The driver keeps the device to itself, and sends it only to a program it can identify: SolidCraft
-as an `.app` (the packaged app). Without the driver, or with its helper not running, SolidCraft reads the device through IOKit like on Windows.
-
-SolidCraft does not follow 3DxWare's profile on macOS. Its default is 3DxWare's object mode.
-
-In the browser: `cd apps/solidcraft-web && trunk build --release --public-url ./` (WebGPU, or
-WebGL2 with `?webgl`; `?sample` opens the sample part).
-
-Agents can control the document open in a browser tab through `window.solidcraft.execute(...)`
-and `window.solidcraft.request(...)`; see the [browser command API](docs/browser-api.md).
-
-## Scripts
-
-A script is a JSON list of commands, the same ones the UI runs:
-
-```json
-{"commands": [
-  {"command": "sketch.create", "params": {"plane": "XY"}},
-  {"command": "sketch.rectangle.two_point", "params": {"p0": [0, 0], "p1": [40, 30]}},
-  {"command": "solid.extrude", "params": {"distance": 20}},
-  {"command": "solid.fillet", "params": {"edges": [[0, 0, 10]], "radius": 3}}
-]}
-```
-
-## AI agents (MCP)
-
-`solidcraft-cli mcp` is a [Model Context Protocol](https://modelcontextprotocol.io) server on
-stdio. Headless it runs its own design session; with `--connect 127.0.0.1:PORT` it drives the app
-started with `solidcraft --control PORT`, so you can watch the agent model. Tools:
-`list_commands`, `execute`, `batch`, `inspect_design`, `measure`, `body_topology`,
-`set_parameter`, `screenshot` (returns the image), `export`, `crash_reports`, `undo`, `redo`,
-`new_design`, `open`, `save`. Tool calls reach files only in the open design's folder (when it lies inside your home
-folder, never home itself or a hidden folder), SolidCraft's recovery folder and folders given with
-`--allow-path DIR`. Claude Code: `claude mcp add solidcraft -- solidcraft-cli mcp`. Details, client
-configuration and an example session: [docs/mcp.md](docs/mcp.md).
-
-## Architecture
-
-<!-- ANCHOR: architecture -->
-| Layer | Crates | Role |
-|---|---|---|
-| L0 | `geom` | vectors, planes, profiles, meshes and their measures |
-| L1 | `sketch`, `kernel`, `render` | constraint solver and profiles; the B-rep kernel boundary (truck); view math and the headless scene description |
-| L2 | `doc` | parameters, expressions, the feature timeline and its incremental evaluation |
-| L3 | `io` | design files, STL/OBJ/STEP/3MF export, STEP and 3MF/STL/OBJ/glTF import features |
-| L4 | `engine` | the session and the command registry (everything is a command) |
-| L5 | `gpu`, `ui-egui`, `mcp` | compute-shader evaluation of display tessellation plans; the swappable desktop front end; the MCP server (headless or bridged to the app) |
-| apps | `solidcraft`, `solidcraft-cli` | desktop app, headless CLI |
-<!-- ANCHOR_END: architecture -->
-
-## Contributing
-
-Coming from Autodesk Fusion? SolidCraft uses familiar parametric CAD workflows: constrained
-sketches, solid features, an editable timeline, parameters and assemblies. See the
-[roadmap](ROADMAP.md) for supported operations and current limitations.
-
-See [CONTRIBUTING.md](CONTRIBUTING.md): how to build and test, the code map, the clean-room
-and licence rules, and where help is wanted most.
-
-## Licence
-
-MIT OR Apache-2.0, at your option. Developed under the
-[clean-room contribution rules](CLAUDE.md); third-party code and assets retain their
-documented licences and attribution.
-
-SolidCraft is independent. Behaviour is designed from public documentation, general CAD
-conventions and user feedback. Reference tests use analytic values and open-source tools.
-SolidCraft is not affiliated with, sponsored by or endorsed by Autodesk. Autodesk and
-Fusion are trademarks of Autodesk, Inc.

ROADMAP.md

@@ -14,6 +14,10 @@ features → parametric timeline) as an open, pure-Rust, agent-drivable applicat
 | Gates | `cargo xtask ci`: fmt, clippy -D warnings, tests, asset attribution, layering, wasm32 build — green |
 | Time to a useful alpha (M0–M6) | ≈ **82 agent hours** remain (sum of the M1–M6 estimates below) |
 
+Optional GPU viewport ambient occlusion is available in View settings and Graphics preferences,
+with persistent settings, Performance/Quality graphics presets (Quality combines AO, Fine tessellation and adaptive 2× supersampling; manual combinations show Custom), and the
+`view.ambient_occlusion` and `view.graphics_preset` commands. See [display settings](docs/ambient-occlusion.md).
+
 ## Scope (owner decision, 2026-10-07)
 
 The issue batch adds preservation of blind pockets in through cuts, associative projected
@@ -46,27 +50,38 @@ PCB / Package, Render, Animation, Simulation, Manufacture/CAM, Drawings.
 | # | Milestone | Status | Hours left |
 |---|---|---|---|
 | M0 | Vertical slice | done | — |
-| M1 | Sketch depth: command coverage implemented — projection/intersect/include as linked geometry (auto-project on faces, lost-reference warnings, break link), full SKETCH create/modify set (slots, polygons, tangent arcs/circles, ellipse, fit/control splines, conic, text, trim/extend/break, fillet/chamfer, offset, mirror, patterns, move/scale, blend curve, centerline), constraints incl. curvature and polygon with over-constraint refusal, driven/arc-length/linear-diameter dimensions, AutoConstrain, DXF/SVG insert, 3D sketch curves (Project To Surface, Intersection Curve, Isoparametric Curve, Spun Profile), exact free-form profiles (B-spline/NURBS edges, any spline degree, curves cut by crossings), sweeps and pipes along 3D sketch curves, canvases and decals, curvature combs. Exact free-form Extend and certified associative offsets now preserve geometry and IDs through edits, deletion and reopen. Occurrence-frame 3D wires now store explicit coordinate spaces and retain points and analytic fits through moves, refresh, undo and reopen. Constructive sketch solving (Owen 1991, Fudos & Hoffmann 1997) ahead of the numerical solver: points and rigid clusters are placed on the branch the sketch had, so dimension edits and drags keep their solution; edits that would turn a sketch over are refused; drags re-solve only the sketch per frame. Remaining workflow repairs: mixed offset junctions, legacy natural-spline seams, and damaged legacy wire links lacking frame provenance | in progress | 4 |
+| M1 | Sketch depth: command coverage implemented — projection/intersect/include as linked geometry (auto-project on faces, lost-reference warnings, break link), full SKETCH create/modify set (slots, polygons, tangent arcs/circles, ellipse, fit/control splines, conic, text, trim/extend/break, fillet/chamfer, offset, mirror, patterns, move/scale, blend curve, centerline), constraints incl. curvature and polygon with over-constraint refusal, Shift-picked line midpoints in Horizontal/Vertical using persisted points and ordinary constraints (#2087), driven/arc-length/linear-diameter dimensions, AutoConstrain, DXF/SVG insert, 3D sketch curves (Project To Surface, Intersection Curve, Isoparametric Curve, Spun Profile), exact free-form profiles (B-spline/NURBS edges, any spline degree, curves cut by crossings), sweeps and pipes along 3D sketch curves, canvases and decals, curvature combs. Exact free-form Extend and certified associative offsets now preserve geometry and IDs through edits, deletion and reopen. Occurrence-frame 3D wires now store explicit coordinate spaces and retain points and analytic fits through moves, refresh, undo and reopen. Constructive sketch solving (Owen 1991, Fudos & Hoffmann 1997) ahead of the numerical solver: points and rigid clusters are placed on the branch the sketch had, so dimension edits and drags keep their solution; edits that would turn a sketch over are refused; drags re-solve only the sketch per frame. Remaining workflow repairs: mixed offset junctions, legacy natural-spline seams, and damaged legacy wire links lacking frame provenance | in progress | 4 |
+| M2 | Robust modelling: coplanar booleans in the kernel, holes (placed on faces, at distances from reference edges, and on sketch points), threads (cosmetic, then modelled), patterns, mirror, shell, draft, split, construction geometry | in progress | 16 |
+| M1 | Sketch depth: command coverage implemented — projection/intersect/include as linked geometry (auto-project on faces, lost-reference warnings, break link), full SKETCH create/modify set (slots, polygons, tangent arcs/circles, ellipse, fit/control splines, conic, text, trim/extend/break, fillet/chamfer, offset, mirror, patterns, move/scale, blend curve, centerline), constraints incl. curvature and polygon with over-constraint refusal, Shift-picked line midpoints in Horizontal/Vertical using persisted points and ordinary constraints (#2087), drawing snaps to where two lines, circles or arcs cross (#4967), driven/arc-length/linear-diameter dimensions, AutoConstrain, DXF/SVG insert, 3D sketch curves (Project To Surface, Intersection Curve, Isoparametric Curve, Spun Profile), exact free-form profiles (B-spline/NURBS edges, any spline degree, curves cut by crossings), sweeps and pipes along 3D sketch curves, canvases and decals, curvature combs. Exact free-form Extend and certified associative offsets now preserve geometry and IDs through edits, deletion and reopen. Occurrence-frame 3D wires now store explicit coordinate spaces and retain points and analytic fits through moves, refresh, undo and reopen. Constructive sketch solving (Owen 1991, Fudos & Hoffmann 1997) ahead of the numerical solver: points and rigid clusters are placed on the branch the sketch had, so dimension edits and drags keep their solution; edits that would turn a sketch over are refused; drags re-solve only the sketch per frame. Remaining workflow repairs: mixed offset junctions, legacy natural-spline seams, and damaged legacy wire links lacking frame provenance | in progress | 4 |
 | M2 | Robust modelling: coplanar booleans in the kernel, holes (placed on faces and on sketch points), threads (cosmetic, then modelled), patterns, mirror, shell, draft, split, construction geometry | in progress | 16 |
-| M3 | General fillets and chamfers (curved edges, chains, vertex blends); saddle rolling-ball surfaces now use continuous seam sections and arc-length fitting with shared contact boundaries and bounded accuracy checks | in progress | 30 |
-| M4 | Files: STEP import (done — [docs/step-import.md](docs/step-import.md)), FreeCAD/Rhino solids through cadmpeg (done, desktop and CLI), 3MF export and 3MF/STL import as mesh bodies (done), 3MF with B-rep face tags ([docs/formats/3mf-face-tags.md](docs/formats/3mf-face-tags.md), done), constant-section parametric mesh reconstruction, DXF sketches, OBJ import | in progress | 6 |
+| M3 | General fillets and chamfers (curved edges, chains, vertex blends); saddle rolling-ball surfaces now use continuous seam sections and arc-length fitting with shared contact boundaries and bounded accuracy checks; tiny rim edges remain selected instead of nearby wall seams when filleting (#2498) | in progress | 30 |
+| M4 | Files: STEP import (done — [docs/step-import.md](docs/step-import.md)), FreeCAD/Rhino solids through cadmpeg (done, desktop, browser and CLI), 3MF export and 3MF/STL import as mesh bodies (done), 3MF with B-rep face tags ([docs/formats/3mf-face-tags.md](docs/formats/3mf-face-tags.md), done), constant-section parametric mesh reconstruction, DXF sketches, OBJ import | in progress | 6 |
 | M5 | Persistent naming of faces and edges (docs/book/src/dev/naming.md): faces named from their exact kernel-reported history (sketch curve sides, caps, revolve sections, primitive sides, blends, shell inner walls, pattern/mirror copies; split pieces told apart by the faces around them, lumps of a cut body named after their faces), edges by their faces; fillets/chamfers, sketches on faces, shell/draft/offset/replace faces, hole placements, joint origins and face appearances resolve by name first and warn when the entity split or vanished: done. sheet metal edges by base sketch line and flange side, shell inner faces, sweep and loft roles: done. kernel-reported face history: done (merged faces answer to every name; operations without history yet fall back to geometric names, flagged unverified; format 14 keeps older designs' geometric names). Left: history through sheet metal, plastic, surface and emboss features; FaceSource certificates through history | in progress | 20 |
-| M6 | UI depth: selection feedback and origin (done), timeline editing (done: hover and selection highlight modifier faces, including fillets and chamfers; edit feature, history marker drag, dependency-checked single and multi-item reorder, suppress, rename, delete with dependents, re-resolved references; redefining selections refreshes persistent edge/face references while retaining feature identity and dimension names; optional compact named left feature history with rollback bar, multi-selection and persistent folders above the parts browser), right-docked dialogs (done), live previews for every feature dialog (done), keyboard-first commands with on-canvas value boxes and sketch inline dimensions (done), drag manipulators with automatic join/cut (done: extrude incl. two sides, fillet, shell, hole depth, move, pattern spacing, revolve rotator, extrude taper), dark theme (done), right-click menu with Repeat (done), measure tool (done), section analysis (done), selection filter (done), drag-solve of sketch points (done); appearance controls now preserve body/face/component targeting, named transparent looks, reuse/search and override removal; preferences | in progress | 6 |
+| M6 | UI depth: selection feedback and origin (done), timeline editing (done: hover and selection highlight modifier faces, including fillets and chamfers; edit feature, history marker drag, dependency-checked single and multi-item reorder, suppress, rename, delete with dependents, re-resolved references; redefining selections refreshes persistent edge/face references while retaining feature identity and dimension names; responsive feature history with width-driven icons/names/title, snapping width resize, bottom/left/browser-stack docking, shared-column collapse, rollback bar, multi-selection and persistent folders), right-docked dialogs (done), live previews for every feature dialog (done), keyboard-first commands with on-canvas value boxes and sketch inline dimensions (done), drag manipulators with automatic join/cut (done: extrude incl. two sides, fillet, shell, hole depth, move, pattern spacing, revolve rotator, extrude taper), dark theme (done), right-click menu with Repeat (done), measure tool (done), section analysis (done), selection filter (done), drag-solve of sketch points (done); appearance controls now preserve body/face/component targeting, named transparent looks, reuse/search and override removal; Browser Expand All / Collapse All (`browser.expand_all`, `browser.collapse_all`) on the design and component menus; preferences | in progress | 6 |
 | M7 | Thin extrude (walls along open or closed curves: centre, inside, outside or two sides; mitred corners, crossing walls joined; #721), sweep, loft (incl. to a point), rib and web (to next / depth), emboss (planar faces and exact radial emboss/deboss of bounded orthogonal profiles on complete exterior cylinders/sleeves), thread (cosmetic, and modelled M3–M20 outside and inside: the ISO profile screwed in as a faceted cut), coil (smooth B-spline helical walls), pipe, pattern on path, patterns of bodies and components, replace face (parallel), align, remove, feature copy/paste: done. Unique eligible cylindrical targets are inferred for new Emboss features. Left: general curved-face emboss and exact (unfaceted) modelled threads | in progress | 12 |
-| M8 | Surface workspace (#772). Done: Patch (sketch regions; edge loops filled G0, plus `crown`), Stitch, Thicken (planes and cylinders), Extend (straight edges of planar surfaces), Trim (by a plane or a face), Delete Face (healing), Boundary Fill, zebra/draft/curvature-map analysis, Surface Extrude/Revolve/Sweep/Loft from open and closed curves, Offset, Unstitch and Reverse Normal; the continuity-driven core (`kernel/src/bridge.rs`, G0–G3 Hermite rows) with **Blend** (`surface.blend`, #764), **Match** (`surface.match`), **Boundary** (`surface.boundary`, #763 — two sketch curves exact with G0–G3, three or four as the flat patch of their loop, and curve networks: Coons and Gordon surfaces through sketch, 3D-sketch or edge curves, a point for a three-sided side, G1/G2 against the faces along one direction's edges, joined into their body on request; G1/G2 on two sides that meet at a corner waits for the Gregory-type corner), **Fair** (`surface.fair`, CV fairing), **continuity analysis** (`inspect.continuity`, #770; a toolbar tool with edge markers and a legend, and curvature combs along face isocurves) and a multi-section **loft** with per-end continuity and crown. Also in the Class-A pass: G1…G4 blend curves in the sketch, chord and variable-radius fillets on curved edges (with honest refusals where the fit cannot hold), and a G2 corner patch where filleted edges meet (kernel; the command refuses until the patch's sections can be sewn to the blends' contacts). Left: bias/form-factor fillet sections (design recorded), a Gregory-type corner, surface Fillet between separate surface bodies (#769), Ruled (#762), Untrim (#761), curved-face Extend (#760), loft guide rails (#201; sweep guide rails and two-rail sweeps are done, #771), and every remaining #757–#772 item | deferred | — |
-| M9 | Components and assemblies: New Component / Create Components from Bodies, active component, per-component origin/bodies/sketches/timeline entries, occurrences with transforms, Copy/Paste vs Paste New, nested Browser tree with visibility and isolate; Ground, Move/Copy of occurrences, joints (rigid, revolute, slider, cylindrical, pin-slot, planar, ball) by joint origins with limits and Drive Joints, closed kinematic loops (four-bar, slider-crank: the loop's other joints follow the driven one on its branch, and driving stops where a loop can no longer close), cams (`joint.cam`: a revolute cam drives a slider or revolute follower along a closed sketch profile or the cam's edges, knife, roller or flat followers, worked out again when the profile changes; drives, studies, closed loops, contact sets), As-built Joint, Rigid Group, Contact Sets (driving and motion studies stop where bodies in a set would pass through each other), Motion Study (joint values keyed along a timeline, playback, export of occurrence positions as JSON/CSV), motion analysis (joint values and a point's path charted over a study as value, velocity and acceleration; the parts that collide along a study, with the steps where they do), Exploded views (automatic or by hand, shown without changing placements); interference, per-component physical properties; STEP with assembly structure; URDF export for robot simulators (links with meshes, mass and inertia; joint chains whose values match Drive Joints; docs/urdf.md). Physical properties now measure material-aware component/occurrence placements, descendants and repeated instances, including pending moves and body reassignment offsets; contact geometry and automatic exploded centres respect those offsets. Groundwork done: component tree, occurrences with transforms (instances, Paste New), world placement, active component as authoring frame, ground, Capture/Revert Position, moving bodies and sketches. UI: ASSEMBLE panel dialogs for New Component, Joint (snaps on faces, edges, circles and vertices; animated motion preview; offsets, flip, limits), As-built Joint, Joint Origin, Rigid Group, Drive Joints (live slider), Motion Link, Cam and Interference (overlaps shown red); joints in the timeline and the Browser | in progress | 32 |
-| M10 | Sheet metal: flange (base, edge, contour), hem, unfold/refold, convert, flat pattern + DXF, rules: done. PLASTIC enclosure subset: Boss, Rib, Web, Lip/Groove, Snap Fit, Rest, Plastic Rules (library, edit, assign; rule draft and clearance as feature defaults): done, tested against hand-computed geometry. UI: SHEET METAL and PLASTIC tabs in Fusion's layout with dialogs (live preview, Edit Feature, pre-selection) for Flange, Hem, Unfold/Refold, Convert, Sheet Metal Rules, Create Flat Pattern (flat view with bend lines, bend table CSV/JSON and DXF export with exact circle/arc/line cutouts), Boss, Lip/Groove, Snap Fit, Rest, Manage and Assign Plastic Rules; Fold (bend along a sketch line); flanges meeting at a corner closed at any angle with the rule's gap; edge flanges with their own angle and height per edge in one feature; corner reliefs (notch, round, rectangular, tear) chosen by the rule; Convert to Sheet Metal from a solid or shelled body by its bend edges (flat faces, sharp bends) | in progress | 36 |
+| M8 | Surface workspace (#772). Done: Patch (sketch regions; edge loops filled G0, plus `crown`), Stitch, Thicken (planes and cylinders), Extend (straight edges of planar surfaces), Trim (by a plane, a face or sketch curves swept onto the surface, keeping a side or the picked regions; mutual trim of two surfaces, extended to meet and stitched, #767), Delete Face (healing), Boundary Fill, zebra/draft/curvature-map analysis, Surface Extrude/Revolve/Sweep/Loft from open and closed curves, Offset, Unstitch and Reverse Normal; the continuity-driven core (`kernel/src/bridge.rs`, G0–G3 Hermite rows) with **Blend** (`surface.blend`, #764: edge chains along one or several faces, closed rims paired seam to seam or from picked seams, a dialog), **Match** (`surface.match`), **Boundary** (`surface.boundary`, #763 — two sketch curves exact with G0–G3, three or four as the flat patch of their loop, and curve networks: Coons and Gordon surfaces through sketch, 3D-sketch or edge curves, a point for a three-sided side, G1/G2 against the faces along one direction's edges, joined into their body on request; G1/G2 on two sides that meet at a corner waits for the Gregory-type corner), **Fair** (`surface.fair`, CV fairing), **continuity analysis** (`inspect.continuity`, #770; a toolbar tool with edge markers and a legend, and curvature combs along face isocurves) and a multi-section **loft** with per-end continuity and crown, and guide rails on solid and surface lofts (one or two, scaling or stretching the sections between; #201). Also in the Class-A pass: G1…G4 blend curves in the sketch, chord and variable-radius fillets on curved edges (with honest refusals where the fit cannot hold), and a G2 corner patch where filleted edges meet (kernel; the command refuses until the patch's sections can be sewn to the blends' contacts). Left: bias/form-factor fillet sections (design recorded), a Gregory-type corner, surface Fillet between separate surface bodies (#769), Ruled (#762), Untrim (#761), curved-face Extend (#760), and every remaining #757–#772 item | deferred | — |
+| M9 | Components and assemblies: New Component / Create Components from Bodies, active component, per-component origin/bodies/sketches/timeline entries, occurrences with transforms, Copy/Paste vs Paste New, nested Browser tree with visibility and isolate; Ground, Move/Copy of occurrences, joints (rigid, revolute, slider, cylindrical, pin-slot, planar, ball) by joint origins with limits and Drive Joints, closed kinematic loops (four-bar, slider-crank: the loop's other joints follow the driven one on its branch, and driving stops where a loop can no longer close), cams (`joint.cam`: a revolute cam drives a slider or revolute follower along a closed sketch profile or the cam's edges, knife, roller or flat followers, worked out again when the profile changes; drives, studies, closed loops, contact sets), As-built Joint, Rigid Group, Contact Sets (driving and motion studies stop where bodies in a set would pass through each other), Motion Study (joint values keyed along a timeline, playback, export of occurrence positions as JSON/CSV), motion analysis (joint values and a point's path charted over a study as value, velocity and acceleration; the parts that collide along a study, with the steps where they do), Exploded views (automatic or by hand, shown without changing placements, and exported as an animation coming apart and back together); interference, per-component physical properties; STEP with assembly structure; URDF export for robot simulators (links with meshes, mass and inertia; joint chains whose values match Drive Joints; docs/urdf.md). Physical properties now measure material-aware component/occurrence placements, descendants and repeated instances, including pending moves and body reassignment offsets; contact geometry and automatic exploded centres respect those offsets. Groundwork done: component tree, occurrences with transforms (instances, Paste New), world placement, active component as authoring frame, ground, Capture/Revert Position, moving bodies and sketches. UI: ASSEMBLE panel dialogs for New Component, Joint (snaps on faces, edges, circles and vertices; animated motion preview; offsets, flip, limits), As-built Joint, Joint Origin, Rigid Group, Drive Joints (live slider), Motion Link, Cam and Interference (overlaps shown red); joints in the timeline and the Browser | in progress | 32 |
+| M10 | Sheet metal: flange (base, edge, contour), hem, unfold/refold, convert, flat pattern + DXF, rules: done. PLASTIC enclosure subset: Boss, Rib, Web, Lip/Groove, Snap Fit, Rest, Plastic Rules (library, edit, assign; rule draft and clearance as feature defaults): done, tested against hand-computed geometry. UI: SHEET METAL and PLASTIC tabs with dialogs (live preview, Edit Feature, pre-selection) for Flange, Hem, Unfold/Refold, Convert, Sheet Metal Rules, Create Flat Pattern (flat view with bend lines, bend table CSV/JSON and DXF export with exact circle/arc/line cutouts), Boss, Lip/Groove, Snap Fit, Rest, Manage and Assign Plastic Rules; Fold (bend along a sketch line); flanges meeting at a corner closed at any angle with the rule's gap; edge flanges with their own angle and height per edge in one feature; corner reliefs (notch, round, rectangular, tear) chosen by the rule; Convert to Sheet Metal from a solid or shelled body by its bend edges (flat faces, sharp bends) | in progress | 36 |
 | M11 | 2D drawings | deferred | — |
-| M12 | Release: cross-platform packages, verification and deliberate publication implemented; original current-UI demo refreshed. Trusted distribution signing and broader performance work remain | in progress | 16 |
+| M12 | Release: cross-platform packages, verification and deliberate publication implemented; original current-UI demo refreshed. macOS Developer ID signing and notarization are in the release workflow (#5749; they switch on when the Apple secrets exist). Windows installer signing and broader performance work remain | in progress | 16 |
 | M14 | Configurations: a table of rows (parameter expressions and feature suppressions per row) switched with config.activate (undoable, all or nothing), kept through parameter renames and feature deletes (config.configure, config.table, config.column/row/activate). Per-row body materials and appearances (library looks, custom colour/opacity and clearing overrides), undoable activation and save/reopen: done. Ordered typed configuration rules, atomic validation and structured rule editing: done. Component appearance and certified semantic face style columns, atomic preview/apply and independent-copy remapping: done. Exact constructed sketch-side and immutable imported-face lineage now preserve legacy names and reject retargeting. Left: ambiguous shifted/two-sided caps | in progress | 4 |
 | M13 | Never lose work: atomic saves (temporary file, flush, rename; a crash at any moment leaves the old file or the new one) with the replaced version kept as `<file>.bak`; autosave of unsaved changes to the recovery folder every 5 minutes (preference) and after big operations, only when something changed; "Recover unsaved design?" on the next launch (`doc.recovery_list`, `doc.recover`, `doc.recovery_discard`); a kill-mid-save test (process killed while saving a 0.5 MB design 25 times). File format: `"format": "solidcraft/12"`, older formats upgraded step by step (`doc::format`), newer ones refused with a message, out-of-range numbers and broken placements refused; a corpus of designs saved by M0, components-era, joints-era and current builds (apps/solidcraft-cli/tests/corpus) that must open and evaluate as saved; damaged and hostile variants (truncation, bit flips, hostile values, removed keys, repeated features, deep nesting) never panic | done | 6 |
+| M15 | Frames and weldments (#4003): structural members along 2D and 3D sketch lines, butt and mitre corners, trim to faces and bodies, end caps, gussets, cosmetic welds and a cut list. Done: the profile library (`frame.profile.list`, `frame.profile.properties`, `frame.profile.insert`): bar, round bar, rectangular and round tube, angle, channel and I-beam, each SolidCraft's own parametric definition with exact fillet arcs and exact section properties (area, centroid, second moments), tested against hand-computed values; members (`frame.member`): one body per straight line of a 2D or 3D frame sketch, following parameter edits, with a built-in profile (its dimensions parameter expressions) or a profile sketch (its drawn material by alternating nested loops), anchor, angle and mirror; each member's name kept with its line. Left: corners, trims, end caps, gussets, welds, cut list, FRAME tab and dialogs | in progress | 60 |
 
 M6 navigation preferences include **Touchpad**: Shift + pointer movement pans, Alt/Option +
 pointer movement orbits without a mouse button, and vertical scrolling zooms. Other presets
 retain their saved two-finger scroll preference; camera motion is available through
 `view.navigate` and modifier-aware `ui.move` automation.
+With the **Fusion** preset and two-finger pan enabled, two fingers pan and Shift + two fingers
+orbit freely, with pinch zoom and mouse bindings unchanged. The shared navigation handler
+applies the same gestures to model and Render views and blocks orbit on flat pages.
 
-M11 precursor: File → Export Current View as DXF exports shown placed bodies from the current
+UI redesign (#2016): the File/start view (#2027) uses shared light/dark navigation,
+action tiles, recent rows and sample cards, with recovery review and Save As/Export
+entry points. Document loading, sample caches and recovery safety retain their
+existing command paths.
+
+M11 precursor: File → Export Current View as DXF exports shown placed bodies and sketches from the current
 camera as a 2D millimetre drawing, with hidden edges omitted or dashed. Vector occlusion splits
 partly hidden edges and includes curved silhouettes. Repeated part meshes and triangle
 hierarchies are shared; bounded desktop preparation and occlusion use up to eight workers.
@@ -85,6 +100,9 @@ completed drawings publish atomically. The browser still exports synchronously.
 
 ## Interactive modelling
 
+- Modelled threads preview their cut before OK using the background worker on desktop.
+  Browser users apply the cut with OK to avoid blocking on every edit.
+
 - Thread resolves a suggested metric size when a cylindrical face is picked. Diameter and
   pitch selectors expose the existing metric designation parameter; custom designations stay
   editable, and Automatic size returns to the face's suggestion. Cosmetic/modelled and
@@ -94,6 +112,8 @@ completed drawings publish atomically. The browser still exports synchronously.
   drag continues, then catch up to the exact final value. Changes to the selected geometry,
   operation or feature still discard obsolete results. Distance arrows and their value boxes
   follow the current frame's input.
+- Large fine modelled threads use pitch-based helix resolution and tighter faceted
+  reconstruction fallbacks, preserving thin crests and closed shells on large shafts.
 
 ## Physical material data
 
@@ -125,6 +145,12 @@ completed drawings publish atomically. The browser still exports synchronously.
 
 ## Render foundation
 
+- Original starter appearances (#1722): 34 opaque recipes through existing commands, with six explicitly unavailable glass recipes and preserved legacy looks; see [the contract](docs/render-starter-appearances.md).
+
+- Bounded linear film accumulation (#1696) supplies caller-admitted mean/variance storage and complete-pass views; actual progressive consumers remain separate. See [the film contract](docs/render-film.md).
+
+- Definition-local visual mapping (#1214) supplies a bounded numerical frame, physical repeat coordinates and a deterministic one-time grain-axis suggestion. It adds no saved record or texture consumer; see [the mapping contract](docs/render-visual-mapping.md).
+
 - Explicit texture normalization (#1218) produces completed float RGBA with
   role-aware linear color/data semantics, bounded matrix/TRC ICC conversion and
   opt-in EXIF orientation. It retains high-precision raw samples and records lossy
@@ -180,6 +206,11 @@ completed drawings publish atomically. The browser still exports synchronously.
 
 ## Dimensioning and error reporting
 
+- Operation length fields share design-unit defaults and input evaluation, including secondary
+  distances, thin walls, blend controls, sheet/plastic rules, joints and motion keys. Canvas
+  handles and sketch previews use the same lengths as committed geometry. Existing stored
+  millimetre values retain their size when edited in a design using another unit (#3271).
+
 - MCP `execute` accepts `verbose: false`, sharing the compact reply helper used by
   `batch`: body changes and created sketch IDs stay, while repeated lists are omitted.
   Both tools retain full replies by default.
@@ -220,6 +251,12 @@ completed drawings publish atomically. The browser still exports synchronously.
   Type a value and press Enter to commit one undo step; rejected values remain editable and
   cancellation leaves the sketch unchanged. Fit keeps geometry clear of the Sketch Palette
   and navigation controls, including enlarged displays and nested pending placements.
+- Sketch Dimension takes a line and a circle or arc (#1803): it measures from the line to the
+  circle's edge (the gap, 0 when tangent, or how far the edge reaches past a line that cuts
+  it), drives it like any other dimension and keeps the circle on its side of the line.
+- Sketch Dimension takes a point and a circle or arc, or two circles or arcs (#4064): it
+  measures to the circle's edge (from the point, or between the two edges: the gap, 0 when
+  they touch, how far they overlap, or the narrowest gap between nested circles).
 - Sketch annotations, live drawing lengths and Measure use document units. Inches show
   three decimals and retain a meaningful fourth digit. Bare length dimension entry captures
   the current design unit; changing units leaves existing geometry and expressions intact.
@@ -317,8 +354,25 @@ completed drawings publish atomically. The browser still exports synchronously.
 - Saved projections from a removed strip retain their geometry and report the lost
   reference. Explicitly reselect the wall to repair that projection.
 
+## Workspace layouts (#2029)
+
+- General preferences save Floating or Compact using the universal UI containers.
+  Compact joins the workspace selector and ribbon, docks the content-hugging Browser
+  flush beneath them with a square join, and opens tool sheets below the compass.
+  Sheets remain draggable, rounding all corners away from their right dock; footer
+  backgrounds follow the same corners. A separate preference hides ribbon icon labels
+  for a shorter ribbon in either layout.
+  Assistant keeps the outermost edge and History keeps its chosen dock. Switching
+  retains the active tool, camera, selection and design; system windows and menus
+  keep their existing behavior.
+
 ## View navigation
 
+- Navigation has an opt-in Free orbit preference for mouse and 3D-mouse rotation through
+  both poles with roll. It defaults off, preserving existing preset snapping and pole limits.
+  The SolidWorks face menu offers Normal to Selection (`view.normal_to`), shared with Look At
+  and Ctrl+8, including repeat-to-flip, preserving scale and projection.
+
 - Desktop Ctrl/Cmd +/- and 0 change or reset the saved UI scale. The scale slider keeps
   its layout stable during a drag and applies the selected scale on release.
 
@@ -338,13 +392,16 @@ completed drawings publish atomically. The browser still exports synchronously.
 
 - Associative shell-face sketches require a unique certified planar source. Nested shell
   attachments and ambiguous coincident sources remain unsupported.
-- G2 fillets: exact quintic blends of straight edges between planar faces, with one perpendicular
-  planar end face at each end. The UI and `solid.fillet` expose `curvature` (alias `g2`); the size
-  is an equivalent circular setback. Curved faces/edges, sloped ends and corner junctions remain unsupported.
+- G2 fillets: exact quintic blends of straight edges between planar faces, with one planar
+  end face at each end, including sloped ends (#2708). The UI and `solid.fillet` expose
+  `curvature` (alias `g2`); the size is an equivalent circular setback. Curved faces/edges,
+  multi-face ends and corner junctions remain unsupported.
 - Fillets and chamfers: constant, variable-radius and chord-length fillets; a radius per edge,
   rounds next to earlier rounds of another radius, and smooth corner patches where three rounds
   meet (a sphere for equal radii); perpendicular corner fillets after a closed ring of earlier
   rounds preserve the ring's radii and the enclosed planar face (#1557);
+  mitres between separate rounds of the same radius keep their endpoint tangent, so a later
+  fillet can select an upright and its adjoining bottom mitre as one chain (#2422);
   straight edges (convex or concave) between planar faces with perpendicular
   planar end faces (equal-distance chamfers also meet sloped planar end faces, including inner
   basin rims within the rim width); convex fillets also meet sloped planar ends and reflex
@@ -453,10 +510,13 @@ completed drawings publish atomically. The browser still exports synchronously.
   and author occurrence paths retain the chosen placements; missing/split faces refuse rather
   than retarget. General free-form profiles, seams, stepped cylinders and other curved surfaces
   remain unsupported. STEP round-trip and independent radial/volume checks cover this subset.
-- Shell and offset faces work on bodies of planes, cylinders, cones and spheres (convex or not:
+- Shell and offset faces work on bodies of planes, cylinders, cones, spheres and tori (convex or not:
   filleted boxes, bosses, domes, countersinks; corners where four or more planes meet, such as a
   floor falling to a drain, as long as the corner's edges are all convex or all concave); draft on convex planar bodies and on walls (planes, cylinders → cones) between caps; lofts through three or more sections are smooth (B-spline sides through every section), two
-  sections ruled.
+  sections ruled. Circular-meridian barrels retain curved inner walls through either axial
+  opening (#2421). Solid lofts preserve holes through sections with matching hole counts
+  (#2435), including inner walls and caps with openings; a hole cannot appear or disappear
+  between sections, and sections with holes cannot collapse to a point.
 
 - Sketch corner tools: fillet and all three chamfer modes pick a connected corner even when
   its endpoint overlaps the fixed origin or a loose point. Ordinary drawing still snaps to
@@ -543,6 +603,10 @@ completed drawings publish atomically. The browser still exports synchronously.
   continuous collision detection; local thin walls and small details remain limitations.
   See [contact-set limits and recovery](docs/contact-sets.md).
 
+## Assembly dragging
+
+The design's first part is grounded when it is made, and a left-button drag repositions a free part (`occurrence.drag`: one undo step, exact occurrence paths including repeated jointed definitions, any floating-chain member carries the chain, grounded parts and joints hold where present, Escape cancels).
+
 ## 3D sketch bridges
 
 3D sketch drawing snaps to points on other visible sketch planes without flattening them onto

apps/solidcraft-cli/Cargo.toml

@@ -19,10 +19,16 @@ path = "src/main.rs"
 name = "solvecraft-cli"
 path = "src/alias.rs"
 
+[features]
+default = ["raytrace-cpu"]
+bundled-render-library = ["solidcraft-engine/bundled-render-library"]
+raytrace-cpu = ["solidcraft-engine/raytrace-cpu"]
+
 [dependencies]
 solidcraft-engine = { workspace = true }
 solidcraft-gpu = { workspace = true }
 solidcraft-mcp = { workspace = true }
+log = { workspace = true }
 serde_json = { workspace = true }
 
 [dev-dependencies]

apps/solidcraft-cli/examples/studio_evidence.rs

@@ -0,0 +1,151 @@
+//! Reproducible evidence through the production command/job interfaces.
+//! Usage: studio_evidence RECIPE.json RENDER-PARAMS.json OUTPUT.png
+//! Writes the editable design, command timings and actual adapter/job metadata beside PNG.
+//! Accepts runtime requests as well as inline or named saved render jobs.
+use serde_json::{Value, json};
+use solidcraft_engine::{
+    Session,
+    doc::render_settings::{RenderJob, RenderSetup},
+    render::job::{CpuHost, ErrorCode, JobId, Phase},
+};
+use std::{
+    io::Read,
+    path::Path,
+    time::{Duration, Instant},
+};
+
+fn read_json(path: &str) -> Result<Value, String> {
+    let mut bytes = Vec::new();
+    std::fs::File::open(path).map_err(|e| format!("{path}: {e}"))?.take(16_777_217).read_to_end(&mut bytes).map_err(|e| e.to_string())?;
+    if bytes.len() > 16_777_216 {
+        return Err("evidence input exceeds 16 MiB".into());
+    }
+    serde_json::from_slice(&bytes).map_err(|e| format!("{path}: {e}"))
+}
+
+// Only decide which optional host must be installed. The production command
+// still validates and resolves the actual request without a second wire format.
+fn needs_gpu(session: &Session, params: &Value) -> Result<bool, String> {
+    let inline = params.get("settings").filter(|value| !value.is_null());
+    let named = params.get("setup").filter(|value| !value.is_null());
+    if inline.is_some() && named.is_some() {
+        return Err("choose either setup or settings".into());
+    }
+    let inline_setup = inline
+        .filter(|value| value.get("job").is_some_and(|job| !job.is_null()))
+        .map(|value| serde_json::from_value::<RenderSetup>(value.clone()).map_err(|e| e.to_string()))
+        .transpose()?;
+    let setup = if let Some(name) = named.and_then(Value::as_str) {
+        Some(session.doc.render.setups.get(name).ok_or("no saved render setup with that name")?)
+    } else {
+        inline_setup.as_ref()
+    };
+    if let Some(setup) = setup
+        && let Some(job) = &setup.job
+    {
+        if params.as_object().is_some_and(|object| object.keys().any(|key| !matches!(key.as_str(), "setup" | "settings" | "replace"))) {
+            return Err("saved render jobs cannot be mixed with runtime controls".into());
+        }
+        setup.validate().map_err(|e| e.to_string())?;
+        return Ok(matches!(job, RenderJob::GpuPath { .. }));
+    }
+    Ok(params.get("progressive").and_then(Value::as_bool) == Some(true))
+}
+
+fn run() -> Result<(), String> {
+    let args: Vec<String> = std::env::args().skip(1).collect();
+    let [recipe_path, params_path, output_path] = args.as_slice() else {
+        return Err("usage: studio_evidence RECIPE.json RENDER-PARAMS.json OUTPUT.png".into());
+    };
+    let output = Path::new(output_path);
+    if !output.extension().is_some_and(|e| e.eq_ignore_ascii_case("png")) {
+        return Err("output must have a .png extension".into());
+    }
+    let recipe = read_json(recipe_path)?;
+    let params = read_json(params_path)?;
+    let mut session = Session::default();
+    eprintln!("Generating original CAD scene from {recipe_path}");
+    let generation_start = Instant::now();
+    let (commands, command_timings) = session.run_script_timed(&recipe, false).map_err(|e| e.to_string())?;
+    let generation_seconds = generation_start.elapsed().as_secs_f64();
+    let design_path = output.with_extension("solidcraft");
+    session.execute("file.save_as", &json!({"path":design_path})).map_err(|e| e.to_string())?;
+    let scene = solidcraft_engine::product_scene::extract(&session).map_err(|e| e.to_string())?;
+    let bodies: Vec<Value> = scene
+        .meshes
+        .iter()
+        .map(|mesh| json!({"name":mesh.name,"vertices":mesh.mesh.positions.len(),"triangles":mesh.mesh.triangles.len()}))
+        .collect();
+    drop(scene);
+
+    let cpu_host_start = Instant::now();
+    session.set_render_job_host(Some(CpuHost::for_platform().map_err(|e| e.to_string())?)).map_err(|e| e.to_string())?;
+    let cpu_host_seconds = cpu_host_start.elapsed().as_secs_f64();
+    // Match runtime and saved-job dispatch. CPU evidence must not require a
+    // Vulkan device, parse GPU policy or initialize a GPU host.
+    let (adapter_report, gpu_host_seconds) = if needs_gpu(&session, &params)? {
+        let gpu_host_start = Instant::now();
+        let policy = solidcraft_gpu::select::Policy::from_env().map_err(|e| e.to_string())?;
+        let (adapter, report) =
+            solidcraft_gpu::select::pick_vulkan(policy, |_| true).ok_or("no Vulkan adapter satisfies the requested GPU policy")?;
+        session.register_render_job_host(solidcraft_gpu::path::host_on_adapter(&adapter).map_err(|e| e.to_string())?).map_err(|e| e.to_string())?;
+        (Some(report), Some(gpu_host_start.elapsed().as_secs_f64()))
+    } else {
+        (None, None)
+    };
+    let preflight = session.execute("render.preflight", &params).map_err(|e| e.to_string())?;
+    let start = Instant::now();
+    let started = session.execute("render.start", &params).map_err(|e| e.to_string())?;
+    let executor = started
+        .get("resolved")
+        .and_then(|resolved| resolved.get("executor"))
+        .and_then(Value::as_str)
+        .ok_or("started job did not report the resolved image executor")?
+        .to_owned();
+    let id: JobId = serde_json::from_value(started.get("job").cloned().ok_or("missing job id")?).map_err(|e| e.to_string())?;
+    let handle = session.render_job_handle(id).map_err(|e| e.to_string())?;
+    eprintln!("Rendering through production {executor} executor");
+    if let Some(adapter) = &adapter_report {
+        eprintln!("GPU adapter: {adapter:?}");
+    }
+    let status = loop {
+        match handle.wait_timeout(Duration::from_secs(10)) {
+            Ok(status) => break status,
+            Err(error) if error.code == ErrorCode::TimedOut && start.elapsed() < Duration::from_secs(3600) => {
+                let status = handle.status().map_err(|e| e.to_string())?;
+                eprintln!(
+                    "Render progress: {:?} {}/{} after {:.1}s",
+                    status.progress.phase,
+                    status.progress.done,
+                    status.progress.total,
+                    start.elapsed().as_secs_f64()
+                );
+            }
+            Err(error) => {
+                let _ = handle.cancel();
+                return Err(error.to_string());
+            }
+        }
+    };
+    let render_and_encode_seconds = start.elapsed().as_secs_f64();
+    if status.progress.phase != Phase::Completed {
+        return Err(status.error.map_or_else(|| "render did not complete".into(), |e| e.to_string()));
+    }
+    let exported = session.execute("render.export", &json!({"job":id,"path":output_path,"overwrite":true})).map_err(|e| e.to_string())?;
+    let report = json!({
+        "recipe":recipe_path,"render_params":params,"executor":executor,"adapter":adapter_report,
+        "environment":{"SOLIDCRAFT_GPU":std::env::var("SOLIDCRAFT_GPU").ok(),"WGPU_BACKEND":std::env::var("WGPU_BACKEND").ok()},
+        "cad_generation_seconds":generation_seconds,"cpu_host_setup_seconds":cpu_host_seconds,"gpu_host_setup_seconds":gpu_host_seconds,
+        "render_and_encode_seconds":render_and_encode_seconds,
+        "timing_scope":"wall time from render.start through completed PNG encoding; includes job preparation and readback, excludes CAD generation, preflight and initial CPU/GPU host setup; GPU setup timing includes adapter selection and pipelines when requested",
+        "bodies":bodies,"commands":commands,"command_timings":command_timings,
+        "preflight":preflight,"export":exported,"editable_design":design_path
+    });
+    std::fs::write(output.with_extension("json"), serde_json::to_vec_pretty(&report).map_err(|e| e.to_string())?).map_err(|e| e.to_string())?;
+    println!("{}", serde_json::to_string_pretty(&report).map_err(|e| e.to_string())?);
+    Ok(())
+}
+
+fn main() -> Result<(), String> {
+    run()
+}

apps/solidcraft-cli/src/bench_agent.rs

@@ -36,8 +36,9 @@ impl Script {
         );
     }
 
+    /// A part placed after it is built: free, even as the design's first part (#2804).
     fn component(&mut self, name: &str) {
-        self.c("component.create", json!({"name": name}));
+        self.c("component.create", json!({"name": name, "grounded": false}));
     }
 
     fn root(&mut self) {

apps/solidcraft-cli/src/bench_assistant.rs

@@ -0,0 +1,701 @@
+//! `bench-assistant`: the standard Assistant model test (v1, #4851), run against a desktop app.
+//!
+//! The app is already running with `--control PORT`; everything goes through its control channel
+//! (`docs/control-protocol.md`), so the command needs no window code of its own. For each task it
+//! starts a new design, runs the task's prescribed setup (a box, for some), adds the endpoint as an
+//! API agent with All permissions, starts a new chat, sends the prompt once and waits for the turn
+//! to end. The result is checked on the design (`document.inspect` with measurements), never on
+//! what the model says, except for the one question whose answer is the reply. A failed task is
+//! put in one of the issue's failure categories from the conversation's items.
+//!
+//! ```text
+//! solidcraft-cli bench-assistant --connect 127.0.0.1:PORT --base-url URL --model NAME
+//!     [--token T] [--tasks 1,2,5] [--repeat N] [--timeout-s 300]
+//!     [--json out.json] [--markdown out.md]
+//! ```
+//! prints a table of the results; `--markdown` writes the issue's comment template filled in,
+//! `--json` every task's rules, conversation and design before and after.
+
+use std::io::{BufRead, BufReader, Write};
+use std::net::{SocketAddr, TcpStream};
+use std::time::{Duration, Instant};
+
+use serde_json::{Value, json};
+
+/// Standard test v1, as #4851 states it. Changing a prompt or a rule makes it another test.
+const TASKS: &str = r#"[
+  {"id": "01-cube", "prompt": "Make a 20 mm cube.", "check": {"bodies": 1, "volume": 8000, "bbox_size": [20, 20, 20]}},
+  {"id": "02-cylinder", "prompt": "Make a cylinder 30 mm in diameter and 50 mm tall.", "check": {"bodies": 1, "volume": 35342.92, "bbox_size": [30, 30, 50]}},
+  {"id": "03-block", "prompt": "Create a block 60 mm long, 40 mm wide and 10 mm thick.", "check": {"bodies": 1, "volume": 24000, "bbox_size": [10, 40, 60]}},
+  {"id": "04-sketch-extrude", "prompt": "Sketch a 50 by 30 mm rectangle on the XY plane and extrude it 15 mm.", "check": {"bodies": 1, "volume": 22500, "bbox_size": [15, 30, 50], "feature_kinds": ["Extrude"]}},
+  {"id": "05-plate-hole", "prompt": "Make a plate 80 x 60 x 10 mm with a 20 mm diameter hole straight through the middle.", "check": {"bodies": 1, "volume": 44858.41, "bbox_size": [10, 60, 80], "note": "80*60*10 - pi*10^2*10"}},
+  {"id": "06-fillet-box", "prompt": "Round all the edges of the box with a 3 mm radius.", "setup": [{"command": "solid.box", "params": {"length": 40, "width": 40, "height": 40}}], "check": {"bodies": 1, "volume": 63108.53, "tol": 0.003, "feature_kinds": ["Fillet"], "note": "all 12 edges of a 40 mm cube rounded r=3"}},
+  {"id": "07-move-body", "prompt": "Move the box 50 mm along the X axis.", "setup": [{"command": "solid.box", "params": {"length": 20, "width": 20, "height": 20}}], "check": {"bodies": 1, "volume": 8000, "bbox_min": [50, 0, 0]}},
+  {"id": "08-rename-body", "prompt": "Rename the body to Bracket.", "setup": [{"command": "solid.box", "params": {"length": 30, "width": 20, "height": 10}}], "check": {"bodies": 1, "volume": 6000, "body_name": "Bracket"}},
+  {"id": "09-volume-question", "prompt": "What is the volume of the part?", "setup": [{"command": "solid.box", "params": {"length": 30, "width": 20, "height": 10}}], "check": {"bodies": 1, "volume": 6000, "unchanged": true, "reply_number": "6[ ,. ]?000(?![0-9])|6(\\.0+)? ?cm"}},
+  {"id": "10-two-holes", "prompt": "Make a 100 x 50 x 5 mm plate and drill two 10 mm holes through it, each 15 mm in from the short ends and centred across the width.", "check": {"bodies": 1, "volume": 24214.6, "bbox_size": [5, 50, 100], "note": "100*50*5 - 2*pi*5^2*5"}},
+  {"id": "11-any-change", "prompt": "can you use the software to make a change to the current shape, any change at all", "setup": [{"command": "solid.box", "params": {"length": 30, "width": 20, "height": 10}}], "check": {"changed": true, "note": "verbatim user prompt from #4846; pass = the design changed"}}
+]"#;
+
+/// The agent the test adds. A fixed id replaces it on every run instead of adding another.
+const AGENT_ID: &str = "api-bench-assistant";
+const AGENT_NAME: &str = "bench";
+/// Longest control reply read (the channel's own request limit).
+const MAX_REPLY: usize = 16 << 20;
+/// Most result data kept for `--json`.
+const MAX_RESULTS: usize = 64 << 20;
+/// Deadline of the requests that only set up or read (each is answered at once by the app).
+const REQUEST_TIMEOUT: Duration = Duration::from_secs(120);
+/// How often a running turn is polled.
+const POLL: Duration = Duration::from_millis(250);
+/// After this long, an idle chat with no reply yet counts as a turn that ended without one.
+const START_GRACE: Duration = Duration::from_secs(30);
+/// Absolute tolerance of the lowest corner, in millimetres.
+const MIN_CORNER_TOL: f64 = 0.05;
+
+/// A JSON-lines connection to the app. Requests are sent once; a lost reply is never retried,
+/// so nothing runs twice.
+struct Control {
+    addr: SocketAddr,
+    token: String,
+    reader: BufReader<TcpStream>,
+    id: u64,
+}
+
+impl Control {
+    fn connect(addr: &str, token: Option<&str>) -> Result<Self, String> {
+        let addr: SocketAddr = addr.parse().map_err(|_| format!("--connect: `{addr}` is not an IP address and port"))?;
+        if !addr.ip().is_loopback() || addr.port() == 0 {
+            return Err("--connect requires a loopback address and a nonzero port (the app listens on 127.0.0.1)".into());
+        }
+        let token = solidcraft_engine::control_auth::client_token(addr.port(), token)
+            .map(|t| t.token)
+            .ok_or("no control token: pass --token, set SOLIDCRAFT_CONTROL_TOKEN, or run on the app's computer (its token file)")?;
+        if token.len() > 4096 {
+            return Err("the control token is longer than 4096 bytes".into());
+        }
+        Self::open(addr, token)
+    }
+
+    fn open(addr: SocketAddr, token: String) -> Result<Self, String> {
+        let stream = TcpStream::connect_timeout(&addr, Duration::from_secs(5)).map_err(|e| format!("connecting to {addr}: {e}"))?;
+        Ok(Self { addr, token, reader: BufReader::new(stream), id: 0 })
+    }
+
+    /// A new connection to the same app: a request that outlived its deadline keeps the old one
+    /// busy until it is answered.
+    fn reopen(&self) -> Result<Self, String> {
+        Self::open(self.addr, self.token.clone())
+    }
+
+    fn call(&mut self, method: &str, params: Value, deadline: Instant) -> Result<Value, String> {
+        let left = || deadline.checked_duration_since(Instant::now()).filter(|d| !d.is_zero()).ok_or_else(|| "timeout".to_string());
+        let io = |e: std::io::Error| match e.kind() {
+            std::io::ErrorKind::TimedOut | std::io::ErrorKind::WouldBlock => "timeout".to_string(),
+            _ => format!("control channel: {e}"),
+        };
+        self.reader.get_ref().set_write_timeout(Some(left()?)).map_err(io)?;
+        self.id += 1;
+        // The first request on a connection carries the token; sending it on every one is allowed.
+        let request = json!({"id": self.id, "method": method, "params": params, "token": self.token});
+        writeln!(self.reader.get_mut(), "{request}").map_err(io)?;
+        let mut line = Vec::new();
+        loop {
+            self.reader.get_ref().set_read_timeout(Some(left()?)).map_err(io)?;
+            let bytes = self.reader.fill_buf().map_err(io)?;
+            if bytes.is_empty() {
+                return Err("the app closed the control connection".into());
+            }
+            let newline = bytes.iter().position(|b| *b == b'\n');
+            let used = newline.map_or(bytes.len(), |n| n + 1);
+            if line.len() + used > MAX_REPLY {
+                return Err("a control reply is larger than 16 MiB".into());
+            }
+            line.extend_from_slice(bytes.get(..used).unwrap_or_default());
+            self.reader.consume(used);
+            if newline.is_some() {
+                break;
+            }
+        }
+        let reply: Value = serde_json::from_slice(&line).map_err(|e| format!("control reply: {e}"))?;
+        if reply["id"].as_u64() != Some(self.id) {
+            return Err("control reply for another request".into());
+        }
+        if reply["ok"] != true {
+            return Err(format!("{method}: {}", reply["error"].as_str().unwrap_or("failed")));
+        }
+        reply.get("result").cloned().ok_or_else(|| format!("{method}: reply without a result"))
+    }
+
+    fn execute(&mut self, command: &str, params: Value) -> Result<Value, String> {
+        self.call("engine.execute", json!({"command": command, "params": params, "animate": false}), Instant::now() + REQUEST_TIMEOUT)
+    }
+
+    fn chat(&mut self, params: Value) -> Result<Value, String> {
+        self.call("ui.agent_chat", params, Instant::now() + REQUEST_TIMEOUT)
+    }
+
+    fn inspect(&mut self) -> Result<Value, String> {
+        let design = self.call("document.inspect", json!({"measure": true}), Instant::now() + REQUEST_TIMEOUT)?;
+        if design.is_object() { Ok(design) } else { Err("document.inspect returned no design".into()) }
+    }
+}
+
+fn tasks() -> Result<Vec<Value>, String> {
+    serde_json::from_str(TASKS).map_err(|e| format!("embedded tasks: {e}"))
+}
+
+fn triple(value: &Value) -> Option<[f64; 3]> {
+    match value.as_array()?.as_slice() {
+        [x, y, z] => {
+            let n = |v: &Value| v.as_f64().filter(|n| n.is_finite());
+            Some([n(x)?, n(y)?, n(z)?])
+        }
+        _ => None,
+    }
+}
+
+/// What the model said (thoughts left out).
+fn reply(items: &[Value]) -> String {
+    items.iter().filter(|i| i["thought"] != true).filter_map(|i| i["agent"].as_str()).collect::<Vec<_>>().join("\n")
+}
+
+/// v1's reply pattern `6[ ,. ]?000(?![0-9])|6(\.0+)? ?cm`: "6000", "6 000", "6,000", "6.000" not
+/// followed by a digit, or "6 cm", "6.0cm", … (a narrow no-break space also separates thousands).
+fn volume_reply(text: &str) -> bool {
+    text.match_indices('6').any(|(at, _)| {
+        let tail = text.get(at + 1..).unwrap_or_default();
+        let thousands = |t: &str| t.strip_prefix("000").is_some_and(|rest| !rest.starts_with(|c: char| c.is_ascii_digit()));
+        let separated = tail.strip_prefix([' ', ',', '.', '\u{202f}']).is_some_and(thousands);
+        let cm = {
+            let t = tail.strip_prefix(".0").map_or(tail, |t| t.trim_start_matches('0'));
+            t.strip_prefix(' ').unwrap_or(t).starts_with("cm")
+        };
+        thousands(tail) || separated || cm
+    })
+}
+
+/// The design as the user sees it, without what reading or saving changes (path, saved state,
+/// revision, selection, undo depth, evaluation timings).
+fn content(design: &Value) -> Value {
+    let mut v = design.clone();
+    if let Some(o) = v.as_object_mut() {
+        for key in ["path", "dirty", "revision", "selection", "undo", "redo"] {
+            o.remove(key);
+        }
+    }
+    for feature in v.get_mut("timeline").and_then(Value::as_array_mut).into_iter().flatten() {
+        if let Some(o) = feature.as_object_mut() {
+            o.remove("ms");
+            o.remove("boolean_diagnostics");
+        }
+    }
+    v
+}
+
+/// Whether the design changed: its content, or a step on the undo stack (a colour, say, that the
+/// inspection does not list).
+fn changed(before: &Value, after: &Value) -> bool {
+    content(before) != content(after) || after["undo"].as_u64() > before["undo"].as_u64()
+}
+
+/// The rules a task's result breaks (none: it passed). `before` and `after` are
+/// `document.inspect {measure: true}` before the prompt and after the turn.
+pub(super) fn check(rule: &Value, before: &Value, after: &Value, items: &[Value]) -> Vec<String> {
+    let Some(all) = after["bodies"].as_array() else { return vec!["the design could not be read".into()] };
+    // Bodies the user sees; a hidden one (a tool body, a hidden original) is not the result.
+    let bodies: Vec<&Value> = all.iter().filter(|b| b["visible"] != false).collect();
+    let mut errors = Vec::new();
+    if let Some(n) = rule["bodies"].as_u64()
+        && bodies.len() as u64 != n
+    {
+        errors.push(format!("{} bodies, expected {n}", bodies.len()));
+    }
+    if let Some(expected) = rule["volume"].as_f64() {
+        let tol = rule["tol"].as_f64().unwrap_or(0.01);
+        let volumes: Vec<f64> = bodies.iter().filter_map(|b| b["volume_mm3"].as_f64()).filter(|v| v.is_finite()).collect();
+        let total: f64 = volumes.iter().sum();
+        if volumes.len() != bodies.len() || (total - expected).abs() > expected * tol {
+            errors.push(format!("volume {total:.1} mm³, expected {expected} mm³ ±{}%", tol * 100.0));
+        }
+    }
+    let first = bodies.first().copied().unwrap_or(&Value::Null);
+    let min = triple(&first["bbox"]["min"]);
+    if let Some(mut expected) = triple(&rule["bbox_size"]) {
+        expected.sort_by(f64::total_cmp);
+        let size = min.zip(triple(&first["bbox"]["max"])).map(|(lo, hi)| {
+            let mut size = [hi[0] - lo[0], hi[1] - lo[1], hi[2] - lo[2]];
+            size.sort_by(f64::total_cmp);
+            size
+        });
+        if !size.is_some_and(|s| s.iter().zip(expected).all(|(a, e)| (a - e).abs() <= 0.01 * e.max(1.0))) {
+            errors.push(format!("size {size:?}, expected {expected:?} in any orientation"));
+        }
+    }
+    if let Some(expected) = triple(&rule["bbox_min"])
+        && !min.is_some_and(|m| m.iter().zip(expected).all(|(a, e)| (a - e).abs() <= MIN_CORNER_TOL))
+    {
+        errors.push(format!("lowest corner {min:?}, expected {expected:?}"));
+    }
+    if let Some(name) = rule["body_name"].as_str()
+        && !bodies.iter().any(|b| b["name"] == name)
+    {
+        errors.push(format!("no body named {name}"));
+    }
+    for kind in rule["feature_kinds"].as_array().into_iter().flatten().filter_map(Value::as_str) {
+        let live = |f: &&Value| f["suppressed"] != true && f["rolled_back"] != true && f["error"].is_null();
+        if !after["timeline"].as_array().into_iter().flatten().filter(live).any(|f| f["type"].as_str().is_some_and(|t| t.contains(kind))) {
+            errors.push(format!("no {kind} in the timeline"));
+        }
+    }
+    if rule["changed"] == true || rule["unchanged"] == true {
+        let changed = before.is_object() && changed(before, after);
+        if rule["changed"] == true && !changed {
+            errors.push("the design did not change".into());
+        }
+        if rule["unchanged"] == true && (changed || !before.is_object()) {
+            errors.push("the design changed".into());
+        }
+    }
+    if rule["reply_number"].is_string() && !volume_reply(&reply(items)) {
+        errors.push("the reply does not give the volume".into());
+    }
+    errors
+}
+
+/// A tool call written into the reply as JSON: `{"name": …`, `{"command": …`, `{"function": …`,
+/// `{"tool": …`.
+fn call_as_text(text: &str) -> bool {
+    text.match_indices('{').any(|(at, _)| {
+        let rest = text.get(at + 1..).unwrap_or_default().trim_start();
+        ["\"name\"", "\"command\"", "\"function\"", "\"tool\""]
+            .iter()
+            .any(|key| rest.strip_prefix(key).is_some_and(|r| r.trim_start().starts_with(':')))
+    })
+}
+
+/// How a failed task failed, in the issue's words, from the conversation's items.
+pub(super) fn classify(items: &[Value], timed_out: bool) -> &'static str {
+    if timed_out {
+        return "timeout";
+    }
+    let tools: Vec<&Value> = items.iter().filter(|i| i.get("tool").is_some()).collect();
+    // A failed call, or a batch whose answer reports a failed step (`"ok": false`).
+    let failed: Vec<String> = tools
+        .iter()
+        .map(|t| t["output"].as_str().unwrap_or_default())
+        .zip(&tools)
+        .filter(|(output, t)| t["status"] == "Failed" || serde_json::from_str::<Value>(output).is_ok_and(|v| v["ok"] == false))
+        .map(|(output, _)| output.to_lowercase())
+        .collect();
+    let notices: Vec<String> = items.iter().filter_map(|i| i["notice"].as_str()).map(str::to_lowercase).collect();
+    let answer = reply(items);
+    if notices.iter().any(|n| n.contains("http 400")) {
+        return "the endpoint refused tools (HTTP 400)";
+    }
+    if notices.iter().any(|n| n.contains("max_turn_requests")) || answer.contains("requests for one message") {
+        return "hit the request limit";
+    }
+    if call_as_text(&answer) {
+        return "wrote the call as text";
+    }
+    if failed.iter().any(|o| o.contains("unknown command") || o.starts_with("unknown tool")) {
+        return "wrong or unknown command";
+    }
+    if failed.iter().any(|o| o.contains("invalid parameters") || o.starts_with("not run:") || o.contains("not valid json")) {
+        return "wrong arguments";
+    }
+    if !failed.is_empty() || notices.iter().any(|n| n.starts_with("http ")) || items.iter().any(|i| i["error"] == true) {
+        return "gave up after errors";
+    }
+    if tools.is_empty() {
+        return if answer.trim().is_empty() { "an empty reply" } else { "only talked" };
+    }
+    "wrong result"
+}
+
+/// One run's results in the issue's comment template (`run`: which repetition).
+pub(super) fn markdown(model: &str, version: &str, results: &[Value], run: u64) -> String {
+    let clean = |s: &str| s.replace(['\n', '\r', '|'], " ");
+    let rows: Vec<&Value> = results.iter().filter(|r| r["repeat"] == run).collect();
+    let passed = rows.iter().filter(|r| r["passed"] == true).count();
+    let mut out = format!(
+        "### {} (<quant>, <download size>)\nRuntime: <Ollama/LM Studio/... version>, context <num_ctx if changed>\nSolidCraft: {}\nResult: {passed}/11\n| # | pass/fail | how it failed |\n|---|---|---|\n",
+        clean(model),
+        clean(version)
+    );
+    for n in 1..=11 {
+        match rows.iter().find(|r| r["task"] == n) {
+            Some(r) if r["passed"] == true => out.push_str(&format!("| {n} | pass | |\n")),
+            Some(r) => out.push_str(&format!("| {n} | fail | {} |\n", clean(r["failure"].as_str().unwrap_or_default()))),
+            None => out.push_str(&format!("| {n} | | not run |\n")),
+        }
+    }
+    out.push_str(if rows.len() == 11 {
+        "Notes: <anything odd, e.g. very slow, needed a retry>\n"
+    } else {
+        "Notes: partial run; the tasks marked \"not run\" were left out.\n"
+    });
+    out
+}
+
+fn write(path: &str, text: &str) -> Result<(), String> {
+    solidcraft_engine::io::vfs::write(path, text.as_bytes()).map_err(|e| format!("{path}: {e}"))
+}
+
+struct Options<'a> {
+    connect: &'a str,
+    token: Option<&'a str>,
+    base_url: &'a str,
+    model: &'a str,
+    tasks: Vec<usize>,
+    repeat: u64,
+    timeout: Duration,
+    json: Option<&'a str>,
+    markdown: Option<&'a str>,
+}
+
+fn options(args: &[String]) -> Result<Options<'_>, String> {
+    const FLAGS: [&str; 9] = ["--connect", "--token", "--base-url", "--model", "--tasks", "--repeat", "--timeout-s", "--json", "--markdown"];
+    let mut given = std::collections::BTreeMap::new();
+    let mut args = args.iter();
+    while let Some(flag) = args.next() {
+        let Some(flag) = FLAGS.iter().find(|f| **f == flag.as_str()) else { return Err(format!("unknown bench-assistant option: {flag}")) };
+        let value = args
+            .next()
+            .filter(|v| !v.starts_with("--") && !v.is_empty() && v.len() <= 4096)
+            .ok_or_else(|| format!("{flag} needs a value (at most 4096 bytes)"))?;
+        if given.insert(*flag, value.as_str()).is_some() {
+            return Err(format!("{flag} given twice"));
+        }
+    }
+    let required = |key: &str| given.get(key).copied().ok_or_else(|| format!("bench-assistant needs {key}"));
+    let number = |key: &str, default: u64, max: u64| -> Result<u64, String> {
+        given
+            .get(key)
+            .map_or(Ok(default), |s| s.parse::<u64>().ok().filter(|n| (1..=max).contains(n)).ok_or_else(|| format!("{key} must be 1 to {max}")))
+    };
+    let tasks = match given.get("--tasks") {
+        None => (1..=11).collect(),
+        Some(list) => {
+            let mut tasks = Vec::new();
+            for n in list.split(',') {
+                let n = n
+                    .trim()
+                    .parse::<usize>()
+                    .ok()
+                    .filter(|n| (1..=11).contains(n))
+                    .ok_or("--tasks takes task numbers 1 to 11, separated by commas")?;
+                if tasks.contains(&n) {
+                    return Err(format!("--tasks lists task {n} twice"));
+                }
+                tasks.push(n);
+            }
+            tasks
+        }
+    };
+    Ok(Options {
+        connect: required("--connect")?,
+        token: given.get("--token").copied(),
+        base_url: required("--base-url")?,
+        model: required("--model")?,
+        tasks,
+        repeat: number("--repeat", 1, 100)?,
+        timeout: Duration::from_secs(number("--timeout-s", 300, 3600)?),
+        json: given.get("--json").copied(),
+        markdown: given.get("--markdown").copied(),
+    })
+}
+
+/// Waits for the turn the prompt started to end. Returns the chat's last state and whether the
+/// deadline passed first.
+fn wait_for_turn(control: &mut Control, mut chat: Value, began: Instant, end: Instant) -> Result<(Value, bool), String> {
+    let mut seen_busy = false;
+    loop {
+        let state = chat["state"].as_str().unwrap_or_default();
+        let turn = !chat["turn"].is_null();
+        let queued = chat["pending"].as_array().is_some_and(|p| !p.is_empty());
+        seen_busy |= state == "busy" || turn;
+        let idle = !matches!(state, "busy" | "starting") && !turn && !queued;
+        // A turn can start and end between two polls: then the conversation has its answer.
+        let answered = chat["items"].as_array().into_iter().flatten().any(|i| i.get("user").is_none());
+        if idle && (seen_busy || answered || matches!(state, "exited" | "auth" | "off") || began.elapsed() >= START_GRACE) {
+            return Ok((chat, false));
+        }
+        let Some(left) = end.checked_duration_since(Instant::now()).filter(|d| !d.is_zero()) else { return Ok((chat, true)) };
+        std::thread::sleep(POLL.min(left));
+        match control.call("ui.agent_chat", json!({}), end) {
+            Ok(next) => chat = next,
+            Err(e) if e == "timeout" => return Ok((chat, true)),
+            Err(e) => return Err(e),
+        }
+    }
+}
+
+pub fn run(args: &[String]) -> Result<(), String> {
+    let o = options(args)?;
+    let tasks = tasks()?;
+    let mut control = Control::connect(o.connect, o.token)?;
+    let help = control.call("ui.help", json!({}), Instant::now() + REQUEST_TIMEOUT)?;
+    let version = help["version"].as_str().filter(|s| !s.is_empty() && s.len() <= 256).ok_or("the app reported no version")?.to_string();
+    let config = control.chat(json!({
+        "features": true,
+        "add_agent": {"id": AGENT_ID, "name": AGENT_NAME, "kind": "api", "base_url": o.base_url, "model": o.model},
+    }))?;
+    if !config["agents"].as_array().into_iter().flatten().any(|a| a["id"] == AGENT_ID) {
+        return Err("the app did not add the benchmark's agent".into());
+    }
+    // Put the user's permission setting back afterwards.
+    let permissions = config["permissions"].as_str().map(str::to_string);
+    let result = run_tasks(&mut control, &o, &tasks, &version);
+    let _ = control.chat(json!({"stop": true}));
+    if let Some(p) = permissions {
+        let _ = control.chat(json!({"permissions": p}));
+    }
+    result
+}
+
+fn run_tasks(control: &mut Control, o: &Options, tasks: &[Value], version: &str) -> Result<(), String> {
+    let mut results: Vec<Value> = Vec::new();
+    let mut kept = 0;
+    let mut stdout = std::io::stdout().lock();
+    let mut say = |line: String| writeln!(stdout, "{line}").map_err(|e| format!("stdout: {e}"));
+    say(format!("bench-assistant v1: {} on SolidCraft {version}", o.model))?;
+    say("| run | # | task | pass/fail | how it failed | seconds |\n|---|---|---|---|---|---|".into())?;
+    for run in 1..=o.repeat {
+        for &n in &o.tasks {
+            let task = tasks.get(n - 1).ok_or("missing embedded task")?;
+            // A fresh design and a fresh chat, with nothing of the last task still running.
+            control.chat(json!({"stop": true}))?;
+            control.execute("file.new", json!({"name": "Benchmark"}))?;
+            for step in task["setup"].as_array().into_iter().flatten() {
+                control.execute(step["command"].as_str().ok_or("embedded setup without a command")?, step["params"].clone())?;
+            }
+            control.chat(json!({"agent": AGENT_ID, "permissions": "all", "new_chat": true, "attach_view": false}))?;
+            let before = control.inspect()?;
+            let began = Instant::now();
+            let end = began + o.timeout;
+            let (chat, timed_out) = match control.call("ui.agent_chat", json!({"send": task["prompt"]}), end) {
+                Ok(chat) => wait_for_turn(control, chat, began, end)?,
+                Err(e) if e == "timeout" => (json!({}), true),
+                Err(e) => return Err(e),
+            };
+            if timed_out {
+                // The late reply would arrive on the old connection; stop the model on a new one
+                // before reading the design.
+                *control = control.reopen()?;
+            }
+            // Stop the agent before reading the result, so nothing changes the design meanwhile.
+            let stopped = control.chat(json!({"stop": true}))?;
+            let items = stopped["items"].as_array().or(chat["items"].as_array()).cloned().unwrap_or_default();
+            let after = control.inspect()?;
+            let failed_rules = check(&task["check"], &before, &after, &items);
+            let passed = failed_rules.is_empty();
+            let failure = if passed { "" } else { classify(&items, timed_out) };
+            let seconds = began.elapsed().as_secs_f64();
+            say(format!(
+                "| {run} | {n} | {} | {} | {failure} | {seconds:.0} |",
+                task["id"].as_str().unwrap_or_default(),
+                if passed { "pass" } else { "fail" }
+            ))?;
+            let result = json!({
+                "task": n, "id": task["id"], "prompt": task["prompt"], "repeat": run, "passed": passed, "failure": failure,
+                "failed_rules": failed_rules, "timed_out": timed_out, "seconds": seconds, "check": task["check"],
+                "items": items, "before": before, "after": after,
+            });
+            kept += result.to_string().len();
+            if kept > MAX_RESULTS {
+                return Err("the results passed 64 MiB; run fewer tasks or repetitions".into());
+            }
+            results.push(result);
+            // Written after every task, so an interrupted run keeps what it measured.
+            if let Some(path) = o.json {
+                let all = json!({"test": "v1", "model": o.model, "base_url": o.base_url, "solidcraft": version, "results": results});
+                write(path, &serde_json::to_string_pretty(&all).map_err(|e| e.to_string())?)?;
+            }
+            if let Some(path) = o.markdown {
+                write(path, &(1..=run).map(|r| markdown(o.model, version, &results, r)).collect::<Vec<_>>().join("\n"))?;
+            }
+        }
+    }
+    for run in 1..=o.repeat {
+        let rows: Vec<&Value> = results.iter().filter(|r| r["repeat"] == run).collect();
+        say(format!("run {run}: {}/{} passed", rows.iter().filter(|r| r["passed"] == true).count(), rows.len()))?;
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn design(bodies: Value, timeline: Value) -> Value {
+        json!({"name": "Benchmark", "params": [], "timeline": timeline, "bodies": bodies, "sketches": [], "undo": 1, "revision": 3, "dirty": true})
+    }
+
+    fn body(name: &str, volume: f64, min: [f64; 3], max: [f64; 3]) -> Value {
+        json!({"name": name, "volume_mm3": volume, "bbox": {"min": min, "max": max}, "visible": true})
+    }
+
+    #[test]
+    fn the_embedded_tasks_are_v1() {
+        let tasks = tasks().unwrap();
+        assert_eq!(tasks.len(), 11);
+        assert_eq!(tasks[0]["prompt"], "Make a 20 mm cube.");
+        assert_eq!(tasks[10]["prompt"], "can you use the software to make a change to the current shape, any change at all");
+        assert_eq!(tasks[5]["check"]["tol"], 0.003);
+        assert_eq!(tasks[6]["check"]["bbox_min"], json!([50, 0, 0]));
+        let boxes: Vec<_> = tasks.iter().filter(|t| t["setup"].is_array()).map(|t| t["id"].as_str().unwrap()).collect();
+        assert_eq!(boxes, ["06-fillet-box", "07-move-body", "08-rename-body", "09-volume-question", "11-any-change"]);
+    }
+
+    #[test]
+    fn pass_rules() {
+        let tasks = tasks().unwrap();
+        let rule = |n: usize| tasks[n - 1]["check"].clone();
+        let empty = design(json!([]), json!([]));
+        let pass = |n: usize, before: &Value, after: &Value, items: &[Value]| check(&rule(n), before, after, items);
+        // 3: any orientation, within 1%.
+        let block = design(json!([body("Body1", 24_100.0, [0.0; 3], [40.0, 10.0, 60.2])]), json!([{"type": "Box"}]));
+        assert!(pass(3, &empty, &block, &[]).is_empty());
+        let thick = design(json!([body("Body1", 24_000.0, [0.0; 3], [40.0, 12.0, 60.0])]), json!([]));
+        assert_eq!(pass(3, &empty, &thick, &[]).len(), 1);
+        let two = design(json!([body("A", 12_000.0, [0.0; 3], [60.0, 40.0, 5.0]), body("B", 12_000.0, [0.0; 3], [60.0, 40.0, 5.0])]), json!([]));
+        assert!(!pass(3, &empty, &two, &[]).is_empty());
+        // A hidden body is not part of the result.
+        let mut hidden = two.clone();
+        hidden["bodies"][1]["visible"] = json!(false);
+        hidden["bodies"][0]["volume_mm3"] = json!(24_000.0);
+        hidden["bodies"][0]["bbox"]["max"] = json!([60.0, 40.0, 10.0]);
+        assert!(pass(3, &empty, &hidden, &[]).is_empty());
+        // 4: the timeline needs a working Extrude.
+        let plate = |kind: Value| design(json!([body("Body1", 22_500.0, [0.0; 3], [50.0, 30.0, 15.0])]), kind);
+        assert!(pass(4, &empty, &plate(json!([{"type": "Sketch"}, {"type": "Extrude"}])), &[]).is_empty());
+        assert!(!pass(4, &empty, &plate(json!([{"type": "Box"}])), &[]).is_empty());
+        for flag in [json!({"suppressed": true}), json!({"rolled_back": true}), json!({"error": "failed"})] {
+            let mut feature = json!({"type": "Extrude"});
+            feature.as_object_mut().unwrap().extend(flag.as_object().unwrap().clone());
+            assert!(!pass(4, &empty, &plate(json!([feature])), &[]).is_empty(), "{flag}");
+        }
+        // 6: the fillet's tolerance is 0.3%.
+        let start = design(json!([body("Body1", 64_000.0, [0.0; 3], [40.0; 3])]), json!([{"type": "Box"}]));
+        let filleted = |v: f64| design(json!([body("Body1", v, [0.0; 3], [40.0; 3])]), json!([{"type": "Box"}, {"type": "Fillet"}]));
+        assert!(pass(6, &start, &filleted(63_108.53 * 1.002), &[]).is_empty());
+        assert!(!pass(6, &start, &filleted(63_108.53 * 1.004), &[]).is_empty());
+        // 7: the lowest corner.
+        let moved = |x: f64| design(json!([body("Body1", 8000.0, [x, 0.0, 0.0], [x + 20.0, 20.0, 20.0])]), json!([]));
+        assert!(pass(7, &empty, &moved(50.0), &[]).is_empty());
+        assert!(!pass(7, &empty, &moved(0.0), &[]).is_empty());
+        // 8: the name.
+        let named = |name: &str| design(json!([body(name, 6000.0, [0.0; 3], [30.0, 20.0, 10.0])]), json!([]));
+        assert!(pass(8, &empty, &named("Bracket"), &[]).is_empty());
+        assert!(!pass(8, &empty, &named("Body1"), &[]).is_empty());
+        // 9: unchanged, and the reply gives the volume.
+        let start = named("Body1");
+        let said = |text: &str| [json!({"user": "What is the volume of the part?"}), json!({"agent": text, "thought": false})];
+        let mut read = start.clone();
+        read["revision"] = json!(7);
+        read["dirty"] = json!(false);
+        read["selection"] = json!([{"body": "Body1"}]);
+        assert!(pass(9, &start, &read, &said("The volume is 6000 mm³.")).is_empty());
+        assert!(!pass(9, &start, &read, &said("About 60 cm³.")).is_empty());
+        assert!(!pass(9, &start, &named("Bracket"), &said("6 000 mm³")).is_empty());
+        let mut undone = start.clone();
+        undone["undo"] = json!(2);
+        assert!(!pass(9, &start, &undone, &said("6000 mm³")).is_empty());
+        // 11: any change counts; reading does not.
+        assert!(pass(11, &start, &named("Bracket"), &[]).is_empty());
+        assert!(pass(11, &start, &undone, &[]).is_empty());
+        assert!(!pass(11, &start, &read, &[]).is_empty());
+        // An unreadable design passes nothing.
+        assert!(!pass(11, &start, &json!({}), &[]).is_empty());
+    }
+
+    #[test]
+    fn the_volume_reply() {
+        for yes in ["6000", "6 000 mm³", "6,000", "6.000", "6\u{202f}000", "6 cm³", "6.00cm3", "is 6000."] {
+            assert!(volume_reply(yes), "{yes}");
+        }
+        for no in ["60000", "6,0001", "60 cm³", "600", "6.01 cm³", ""] {
+            assert!(!volume_reply(no), "{no}");
+        }
+    }
+
+    #[test]
+    fn failure_categories() {
+        for (items, expected) in [
+            (
+                json!([{"user": "Make a 20 mm cube."}, {"agent": "{\"name\": \"execute\", \"arguments\": {}}", "thought": false}]),
+                "wrote the call as text",
+            ),
+            (
+                json!([{"notice": "HTTP 400: registry.ollama.ai/library/gemma3:4b does not support tools", "error": true}]),
+                "the endpoint refused tools (HTTP 400)",
+            ),
+            (json!([{"user": "Make a 20 mm cube."}, {"agent": "", "thought": false}]), "an empty reply"),
+            (json!([{"agent": "Let me think", "thought": true}]), "an empty reply"),
+            (json!([{"agent": "Sure, here is how to make a cube.", "thought": false}]), "only talked"),
+            (
+                json!([{"tool": "1", "status": "Failed", "output": "unknown command `solid.cube` (did you mean `solid.box`?)"}]),
+                "wrong or unknown command",
+            ),
+            (json!([{"tool": "1", "status": "Failed", "output": "unknown tool `make_cube`"}]), "wrong or unknown command"),
+            (json!([{"tool": "1", "status": "Failed", "output": "invalid parameters for `solid.box`: `length` is required"}]), "wrong arguments"),
+            (json!([{"tool": "1", "status": "Failed", "output": "Not run: the tool arguments were not valid JSON"}]), "wrong arguments"),
+            (json!([{"tool": "1", "status": "Failed", "output": "no body `Box`"}]), "gave up after errors"),
+            (
+                json!([{"tool": "1", "status": "Completed", "output": "{\"ok\": false, \"failed\": {\"error\": \"unknown command `solid.delete`\"}}"}]),
+                "wrong or unknown command",
+            ),
+            (
+                json!([{"tool": "1", "status": "Completed"}, {"agent": "\n(stopped after 24 requests for one message; send another message to go on)"}]),
+                "hit the request limit",
+            ),
+            (json!([{"tool": "1", "status": "Completed", "output": "{}"}]), "wrong result"),
+        ] {
+            let items = items.as_array().unwrap();
+            assert_eq!(classify(items, false), expected, "{items:?}");
+            assert_eq!(classify(items, true), "timeout");
+        }
+    }
+
+    #[test]
+    fn markdown_is_the_comment_template() {
+        let rows: Vec<Value> =
+            (1..=11).map(|n| json!({"task": n, "repeat": 1, "passed": n != 2, "failure": if n == 2 { "an empty reply" } else { "" }})).collect();
+        let report = markdown("qwen2.5:7b", "0.19.0", &rows, 1);
+        assert!(report.starts_with(
+            "### qwen2.5:7b (<quant>, <download size>)\nRuntime: <Ollama/LM Studio/... version>, context <num_ctx if changed>\nSolidCraft: 0.19.0\nResult: 10/11\n| # | pass/fail | how it failed |\n|---|---|---|\n| 1 | pass | |\n| 2 | fail | an empty reply |\n"
+        ));
+        assert!(report.ends_with("| 11 | pass | |\nNotes: <anything odd, e.g. very slow, needed a retry>\n"));
+        let partial = markdown("m|x", "v", &rows[..1], 1);
+        assert!(partial.starts_with("### m x ("));
+        assert!(partial.contains("Result: 1/11") && partial.contains("| 2 | | not run |") && partial.contains("partial run"));
+    }
+
+    #[test]
+    fn options_are_checked_before_connecting() {
+        for extra in [
+            &["--repeat", "0"][..],
+            &["--repeat", "101"],
+            &["--timeout-s", "3601"],
+            &["--tasks", "0"],
+            &["--tasks", "12"],
+            &["--tasks", "1,1"],
+            &["--model", "again"],
+            &["--unexpected", "1"],
+            &["--token"],
+        ] {
+            let mut args: Vec<String> =
+                ["--connect", "127.0.0.1:9", "--model", "m", "--base-url", "http://127.0.0.1:11434/v1"].iter().map(|s| s.to_string()).collect();
+            args.extend(extra.iter().map(|s| s.to_string()));
+            assert!(options(&args).is_err(), "{extra:?}");
+        }
+        let args: Vec<String> =
+            ["--connect", "127.0.0.1:9", "--model", "m", "--base-url", "u", "--tasks", "2, 5"].iter().map(|s| s.to_string()).collect();
+        let o = options(&args).unwrap();
+        assert_eq!((o.tasks, o.repeat, o.timeout), (vec![2, 5], 1, Duration::from_secs(300)));
+        assert!(Control::connect("10.0.0.1:9271", Some("t")).is_err());
+        assert!(Control::connect("localhost", Some("t")).is_err());
+    }
+}

apps/solidcraft-cli/src/crashes.rs

@@ -6,11 +6,14 @@ use std::sync::Mutex;
 use serde_json::{Value, json};
 use solidcraft_engine::crash;
 
-const USAGE: &str = "usage: solidcraft-cli crashes [list [--json] | show <id> | replay <id> | dir | clear [<id>]]";
+/// The command's usage, from the same lines the top-level usage lists.
+fn usage() -> String {
+    crate::command_usage("crashes")
+}
 
 pub fn run(args: &[String]) -> Result<(), String> {
     let dir = crash::default_dir().ok_or("no crash folder on this system")?;
-    let id = || args.get(1).map(String::as_str).ok_or_else(|| USAGE.to_string());
+    let id = || args.get(1).map(String::as_str).ok_or_else(usage);
     match args.first().map(String::as_str) {
         None | Some("list") => {
             let reports = crash::list(&dir);
@@ -43,7 +46,7 @@ pub fn run(args: &[String]) -> Result<(), String> {
             println!("deleted {} report(s)", crash::clear(&dir, args.get(1).map(String::as_str)));
             Ok(())
         }
-        _ => Err(USAGE.to_string()),
+        _ => Err(usage()),
     }
 }
 

apps/solidcraft-cli/src/fuzz.rs

@@ -16,9 +16,16 @@ fn flag<T: std::str::FromStr>(args: &[String], name: &str, default: T) -> T {
     args.iter().position(|a| a == name).and_then(|i| args.get(i + 1)).and_then(|v| v.parse().ok()).unwrap_or(default)
 }
 
+/// The options `fuzz` takes, and the ones that stand alone.
+const OPTIONS: &[&str] = &["--from", "--count", "--jobs", "--timeout", "--steps", "--out", "--report"];
+const SWITCHES: &[&str] = &["--minimise"];
+
 /// One seed: a design and a boolean case, as JSON on stdout (progress on stderr).
 pub fn one(args: &[String]) -> Result<(), String> {
     let seed: u64 = args.first().and_then(|s| s.parse().ok()).ok_or("fuzz-one <seed> [--steps N] [--minimise]")?;
+    // The seed is the first argument; the rest are options, and an option `fuzz-one` doesn't
+    // take is refused rather than ignored.
+    crate::known_args("fuzz-one", &args[1..], &["--steps"], SWITCHES, false)?;
     let steps = flag(args, "--steps", 8usize);
     let minimise = args.iter().any(|a| a == "--minimise");
     // Panics caught inside the kernel: harmless natively, fatal in the web build.
@@ -64,6 +71,9 @@ struct Job {
 /// Run seeds `--from`…`--from + --count` in `--jobs` processes, `--timeout` seconds each;
 /// write failing scripts to `--out` and a summary to `--report`.
 pub fn run(args: &[String]) -> Result<(), String> {
+    // An option `fuzz` doesn't take is refused before a seed runs: it would otherwise be
+    // ignored, and the run would go on for minutes with the wrong settings.
+    crate::known_args("fuzz", args, OPTIONS, SWITCHES, false)?;
     let from = flag(args, "--from", 0u64);
     let count = flag(args, "--count", 100u64);
     let last = from.checked_add(count.saturating_sub(1)).ok_or("seed range exceeds u64::MAX: reduce --from or --count")?;

apps/solidcraft-cli/src/logger.rs

@@ -0,0 +1,49 @@
+//! What the engine logs (`log::info!`, `log::debug!`: why a body has no display plan, why a save
+//! left its model cache out), written to stderr. Off unless asked for, so the CLI's output and
+//! the scripts reading it stay as they are: `--debug` shows SolidCraft's own debug messages (and
+//! other crates' warnings, whose debug output is large), `RUST_LOG=error|warn|info|debug|trace`
+//! sets one level for every crate.
+
+use log::{LevelFilter, Log, Metadata, Record};
+
+struct Stderr {
+    /// The level for SolidCraft's crates.
+    ours: LevelFilter,
+    /// The level for every other crate.
+    others: LevelFilter,
+}
+
+impl Log for Stderr {
+    fn enabled(&self, m: &Metadata) -> bool {
+        m.level() <= if m.target().starts_with("solidcraft") { self.ours } else { self.others }
+    }
+
+    fn log(&self, r: &Record) {
+        if self.enabled(r.metadata()) {
+            use std::io::Write as _;
+            // A closed stderr is no reason to stop.
+            let _ = writeln!(std::io::stderr().lock(), "[{} {}] {}", r.level().as_str().to_ascii_lowercase(), r.target(), r.args());
+        }
+    }
+
+    fn flush(&self) {}
+}
+
+/// Removes `--debug` from `args`, wherever it is (every subcommand takes it), and installs the
+/// logger when it or `RUST_LOG` asks for one.
+pub fn init(args: &mut Vec<String>) {
+    let before = args.len();
+    args.retain(|a| a != "--debug");
+    let debug = args.len() != before;
+    let env = std::env::var("RUST_LOG").ok().and_then(|v| v.trim().parse::<LevelFilter>().ok());
+    let (ours, others) = match (debug, env) {
+        (false, Some(all)) => (all, all),
+        (true, Some(all)) => (all.max(LevelFilter::Debug), all),
+        (true, None) => (LevelFilter::Debug, LevelFilter::Warn),
+        (false, None) => return,
+    };
+    // Installed once, for the life of the process.
+    if log::set_logger(Box::leak(Box::new(Stderr { ours, others }))).is_ok() {
+        log::set_max_level(ours.max(others));
+    }
+}

apps/solidcraft-cli/src/main.rs

@@ -4,25 +4,36 @@
 //! solidcraft-cli run <script.json|design.solidcraft|part.step|mesh.3mf> [--in design|part.step|mesh.3mf] [--out FILE]... [--save FILE] [--quiet] [--results] [--timings] [--profile] [--json-out FILE] [--allow-errors]
 //! solidcraft-cli eval <script.json|design.solidcraft|part.step> [--json-out FILE] (alias: inspect) measurements as JSON
 //! solidcraft-cli script <design.solidcraft> [--out script.json]     the design's history as a command script
-//! solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only] [--display LEVEL [--edit NAME EXPR]] loading timings as JSON lines
+//! solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only] [--save OUT.solidcraft] [--display LEVEL [--edit NAME EXPR]] [--ops script.json] loading timings as JSON lines
 //! solidcraft-cli bench-agent [--scale F] [--save F] [--script-out F] a ~1,300-body design built command by command, timed
+//! solidcraft-cli bench-assistant --connect 127.0.0.1:PORT [--token T] --base-url URL --model NAME [--tasks 1,2,5] [--repeat N]
+//!                                 [--timeout-s 300] [--json out.json] [--markdown out.md]
+//!                                                             the standard Assistant model test (#4851) on a running app
 //! solidcraft-cli snapshot <script|design> [--in design|part.step] --out shot.png [--width W] [--height H] [--view iso|front|top|…|NAME | --camera JSON] [--no-grid] [--no-axes]
+//!                                                             [--body NAME:opacity=0.3,color=#rrggbb]... [--tool NAME]... [--section z=27]
 //! solidcraft-cli exec <command> [json-params]                 run one command on an empty design
 //! solidcraft-cli commands                                     the command registry as JSON
 //! solidcraft-cli recipe <recipe.json>                         translate an oracle recipe to a script
 //! solidcraft-cli oracle <case-dir>...                         replay recipes and compare with expected.json
-//! solidcraft-cli mcp [--in design|script] [--connect HOST:PORT [--token T]] [--allow-path DIR]... [--allow-any-path]
+//! solidcraft-cli mcp [--headless] [--in design|script] [--connect HOST:PORT [--token T]] [--allow-path DIR]... [--allow-any-path]
+//!                    [--param-check off|warn|strict]
 //!                                                             MCP server on stdio (docs/mcp.md)
+//! solidcraft-cli mcp setup [--dry-run] [--client NAME] [--live] (alias: mcp install) add it to OpenCode, Claude Desktop, Claude Code, Cursor
 //! solidcraft-cli licences                                     SolidCraft's licence and the third-party licences
 //! solidcraft-cli icon --out F.png|F.ico [--size N]             the app icon (packaging; drawn, not a file)
+//!
+//! --debug (with any command)                                  SolidCraft's debug log on stderr (or RUST_LOG=LEVEL)
 //! ```
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 #![forbid(unsafe_code)]
 
 mod bench_agent;
+mod bench_assistant;
 mod crashes;
 mod fuzz;
+mod logger;
 mod oracle;
+mod preview;
 mod recipe;
 mod render;
 mod spatial;
@@ -36,44 +47,98 @@ mod app_icon;
 use solidcraft_engine::Session;
 use solidcraft_engine::view::Guides;
 
-const USAGE: &str = "usage:
-  solidcraft-cli run <script.json|design.solidcraft|part.step> [--in design.solidcraft|part.step] [--out FILE]... [--save FILE] [--quiet] [--results] [--timings] [--profile] [--json-out FILE] [--allow-errors]
-  solidcraft-cli run --in <design.solidcraft|part.step> [--out FILE]...
-      (a timeline feature that fails fails the run and nothing is written; --allow-errors writes anyway)
-      (--timings prints {timings: [{index, command, ms}], total_ms} for a script, with --results its results too;
-       --profile adds each command's profile: {boolean_ms, tessellate_ms, other_ms}, the kernel's share)
-  solidcraft-cli eval <script.json|design.solidcraft|part.step> [--json-out FILE]     (alias: inspect; or --in FILE)
-      (--json-out FILE writes the JSON that run (with --results, else the measurement) and eval print to FILE instead of stdout,
-       as plain UTF-8: a shell's > can re-encode it, e.g. Windows PowerShell adds a byte-order mark)
-  solidcraft-cli script <design.solidcraft|script.json> [--out script.json]
-      (the design's history as a command script that eval and run replay)
-  solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only] [--display LEVEL [--edit NAME EXPR]]
-  solidcraft-cli bench-agent [--scale F] [--save design.solidcraft] [--script-out script.json]
-  solidcraft-cli snapshot <script|design> [--in design.solidcraft|part.step] --out shot.png [--width W] [--height H] [--view NAME | --camera JSON] [--no-grid] [--no-axes]
-  solidcraft-cli snapshot --in <design.solidcraft|part.step> --out shot.png ...
-      (as with run, --in starts from a design and the script runs on top of it; an option snapshot doesn't take is an error;
-       --view: iso, front, back, top, bottom, left, right, or the name of a view saved in the design with view.save;
-       --camera: {target: [x,y,z], yaw, pitch, distance, fov?} in mm and radians, as the MCP screenshot takes it (docs/mcp.md);
-       --no-grid and --no-axes leave the ground grid (on Z 0) and the origin's axes out of the picture)
-  solidcraft-cli render <script|design> --out image.png [--setup NAME] [--width W] [--height H] [--transparent] [--overwrite] [--timeout SECONDS]
-  solidcraft-cli exec <command> [json-params]
-  solidcraft-cli commands
-  solidcraft-cli recipe <recipe.json>
-  solidcraft-cli oracle <case-dir>... [--json]
-  solidcraft-cli fuzz [--from N] [--count N] [--jobs J] [--timeout S] [--steps N] [--minimise] [--out DIR] [--report FILE]
-  solidcraft-cli mcp [--in design.solidcraft|script.json] [--connect 127.0.0.1:PORT [--token T]] [--allow-path DIR]... [--allow-any-path]
-  solidcraft-cli crashes [list [--json] | show <id> | replay <id> | dir | clear [<id>]]
-  solidcraft-cli licences
-  solidcraft-cli gpu [--policy auto|hardware|software|cpu]
-      (the GPU adapters a headless render can open, best first, the one the policy picks and the tier it
-       lands on: gpu, gpu-software, or the CPU rasterizer (auto with no adapter, or cpu); the policy defaults
-       to SOLIDCRAFT_GPU, else auto; exits with an error when hardware or software finds no such adapter)
-  solidcraft-cli icon --out icon.png [--size 256] | --out icon.ico
-";
+/// One command the CLI takes: the name to type, the usage it prints for `--help`,
+/// and whether the top-level usage lists it (an alias answers to another command's name).
+struct Command {
+    name: &'static str,
+    usage: &'static str,
+    listed: bool,
+}
+
+/// `run`'s lines in the usage.
+const USAGE_RUN: &str = "  solidcraft-cli run <script.json|design.solidcraft|part.step> [--in design.solidcraft|part.step] [--out FILE]... [--save FILE] [--quiet] [--results] [--timings] [--profile] [--json-out FILE] [--allow-errors]\n  solidcraft-cli run --in <design.solidcraft|part.step> [--out FILE]...\n      (a timeline feature that fails fails the run and nothing is written; --allow-errors writes anyway)\n      (--timings prints {timings: [{index, command, ms}], total_ms} for a script, with --results its results too;\n       --profile adds each command's profile: {boolean_ms, tessellate_ms, other_ms}, the kernel's share)\n";
+/// `eval`'s lines in the usage.
+const USAGE_EVAL: &str = "  solidcraft-cli eval <script.json|design.solidcraft|part.step> [--json-out FILE]     (alias: inspect; or --in FILE)\n      (--json-out FILE writes the JSON that run (with --results, else the measurement) and eval print to FILE instead of stdout,\n       as plain UTF-8: a shell's > can re-encode it, e.g. Windows PowerShell adds a byte-order mark)\n";
+/// `script`'s lines in the usage.
+const USAGE_SCRIPT: &str = "  solidcraft-cli script <design.solidcraft|script.json> [--out script.json]\n      (the design's history as a command script that eval and run replay)\n";
+/// `bench-open`'s lines in the usage.
+const USAGE_BENCH_OPEN: &str = "  solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only] [--save OUT.solidcraft] [--display LEVEL [--edit NAME EXPR]] [--ops script.json]\n      (--ops: after opening, run each command of the script and undo it, timing the command, the\n       evaluations it caused and the view it leaves: placing and meshing what changed)\n";
+/// `bench-agent`'s lines in the usage.
+const USAGE_BENCH_AGENT: &str = "  solidcraft-cli bench-agent [--scale F] [--save design.solidcraft] [--script-out script.json]\n";
+/// `bench-assistant`'s lines in the usage.
+const USAGE_BENCH_ASSISTANT: &str = "  solidcraft-cli bench-assistant --connect 127.0.0.1:PORT [--token T] --base-url URL --model NAME [--tasks 1,2,5] [--repeat N] [--timeout-s 300] [--json out.json] [--markdown out.md]\n";
+/// `snapshot`'s lines in the usage.
+const USAGE_SNAPSHOT: &str = "  solidcraft-cli snapshot <script|design> [--in design.solidcraft|part.step] --out shot.png [--width W] [--height H] [--view NAME | --camera JSON] [--no-grid] [--no-axes]\n      [--body NAME:opacity=0.3,color=#rrggbb]... [--tool NAME]... [--section z=27]\n  solidcraft-cli snapshot --in <design.solidcraft|part.step> --out shot.png ...\n      (as with run, --in starts from a design and the script runs on top of it; an option snapshot doesn't take is an error;\n       --view: iso, front, back, top, bottom, left, right, or the name of a view saved in the design with view.save;\n       --camera: {target: [x,y,z], yaw, pitch, distance, fov?} in mm and radians, as the MCP screenshot takes it (docs/mcp.md);\n       --no-grid and --no-axes leave the ground grid (on Z 0) and the origin's axes out of the picture;\n       --body: how one body is drawn, as appearance.assign takes it: opacity 0-1 (below 1 is see-through, so what is inside\n         it shows) and color #rrggbb, either or both, once per body;\n       --tool: draw this body solid in the tool colour and every other body see-through, so a cut's or a join's tool body\n         is visible inside the material it meets; a later --body overrides it;\n       --section: cut the model as inspect.section does, so the inside shows: z=27 (the plane through that world\n         coordinate, keeping the smaller side), add ,flip to keep the other side, or XY, XZ, YZ, or its own JSON)\n";
+/// `render`'s lines in the usage.
+const USAGE_RENDER: &str = "  solidcraft-cli render <script|design> --out image.png [--setup NAME] [--width W] [--height H] [--transparent] [--overwrite] [--timeout SECONDS]\n      [--progressive] [--samples N] [--max-depth N] [--seed N] [--exposure EV] [--lighting FILE.json] [--environment FILE.json] [--tone-map reinhard|aces_fitted]\n";
+/// `exec`'s lines in the usage.
+const USAGE_EXEC: &str = "  solidcraft-cli exec <command> [json-params]\n";
+/// `commands`'s lines in the usage.
+const USAGE_COMMANDS: &str = "  solidcraft-cli commands\n";
+/// `recipe`'s lines in the usage.
+const USAGE_RECIPE: &str = "  solidcraft-cli recipe <recipe.json>\n";
+/// `oracle`'s lines in the usage.
+const USAGE_ORACLE: &str = "  solidcraft-cli oracle <case-dir>... [--json]\n";
+/// `fuzz`'s lines in the usage.
+const USAGE_FUZZ: &str =
+    "  solidcraft-cli fuzz [--from N] [--count N] [--jobs J] [--timeout S] [--steps N] [--minimise] [--out DIR] [--report FILE]\n";
+/// `mcp`'s lines in the usage.
+const USAGE_MCP: &str = "  solidcraft-cli mcp [--headless] [--in design.solidcraft|script.json] [--connect 127.0.0.1:PORT [--token T]] [--allow-path DIR]... [--allow-any-path]\n                     [--param-check off|warn|strict] [--render-gpu]\n  solidcraft-cli mcp setup [--dry-run] [--client opencode|claude-desktop|claude-code|cursor] [--live]\n      (adds a `solidcraft` server, with this program's path, to each installed AI client; --live adds `solidcraft-live` for the running app; alias: mcp install)\n";
+/// `crashes`'s lines in the usage.
+const USAGE_CRASHES: &str = "  solidcraft-cli crashes [list [--json] | show <id> | replay <id> | dir | clear [<id>]]\n";
+/// `licences`'s lines in the usage.
+const USAGE_LICENCES: &str = "  solidcraft-cli licences\n";
+/// `gpu`'s lines in the usage.
+const USAGE_GPU: &str = "  solidcraft-cli gpu [--policy auto|hardware|software|cpu]\n      (the GPU adapters a headless render can open, best first, the one the policy picks and the tier it\n       lands on: gpu, gpu-software, or the CPU rasterizer (auto with no adapter, or cpu); the policy defaults\n       to SOLIDCRAFT_GPU, else auto; exits with an error when hardware or software finds no such adapter)\n";
+/// `icon`'s lines in the usage.
+const USAGE_ICON: &str = "  solidcraft-cli icon --out icon.png [--size 256] | --out icon.ico\n";
+/// `fuzz-one`'s lines in the usage: a seed and the flags of one fuzz run.
+const USAGE_FUZZ_ONE: &str = "  solidcraft-cli fuzz-one <seed> [--steps N] [--minimise]\n";
+/// `bench-edit`'s lines in the usage: the parameter a script changes.
+const USAGE_BENCH_EDIT: &str = "  solidcraft-cli bench-edit <script.json|recipe.json> <param> <expr>\n";
+/// `save-stress`'s lines in the usage: the file saved over and over.
+const USAGE_SAVE_STRESS: &str = "  solidcraft-cli save-stress <path> <rounds>\n";
+/// The flags every command takes, at the end of the top-level usage.
+const USAGE_DEBUG: &str = "  --debug, with any command: what SolidCraft logs (why a body has no display plan, why a save left its\n      model cache out), on stderr; RUST_LOG=error|warn|info|debug|trace sets one level for every crate\n";
+
+/// The commands the CLI takes, in the order the top-level usage lists them.
+const COMMANDS: &[Command] = &[
+    Command { name: "run", usage: USAGE_RUN, listed: true },
+    Command { name: "eval", usage: USAGE_EVAL, listed: true },
+    Command { name: "inspect", usage: USAGE_EVAL, listed: false },
+    Command { name: "script", usage: USAGE_SCRIPT, listed: true },
+    Command { name: "bench-open", usage: USAGE_BENCH_OPEN, listed: true },
+    Command { name: "bench-agent", usage: USAGE_BENCH_AGENT, listed: true },
+    Command { name: "bench-assistant", usage: USAGE_BENCH_ASSISTANT, listed: true },
+    Command { name: "snapshot", usage: USAGE_SNAPSHOT, listed: true },
+    Command { name: "render", usage: USAGE_RENDER, listed: true },
+    Command { name: "exec", usage: USAGE_EXEC, listed: true },
+    Command { name: "commands", usage: USAGE_COMMANDS, listed: true },
+    Command { name: "recipe", usage: USAGE_RECIPE, listed: true },
+    Command { name: "oracle", usage: USAGE_ORACLE, listed: true },
+    Command { name: "fuzz", usage: USAGE_FUZZ, listed: true },
+    Command { name: "fuzz-one", usage: USAGE_FUZZ_ONE, listed: false },
+    Command { name: "mcp", usage: USAGE_MCP, listed: true },
+    Command { name: "crashes", usage: USAGE_CRASHES, listed: true },
+    Command { name: "licences", usage: USAGE_LICENCES, listed: true },
+    Command { name: "licenses", usage: USAGE_LICENCES, listed: false },
+    Command { name: "gpu", usage: USAGE_GPU, listed: true },
+    Command { name: "icon", usage: USAGE_ICON, listed: true },
+    Command { name: "bench-edit", usage: USAGE_BENCH_EDIT, listed: false },
+    Command { name: "save-stress", usage: USAGE_SAVE_STRESS, listed: false },
+];
 
 fn main() -> ExitCode {
-    let args: Vec<String> = std::env::args().skip(1).collect();
+    let mut args: Vec<String> = std::env::args().skip(1).collect();
+    logger::init(&mut args);
     let r = match args.first().map(String::as_str) {
+        // Asked-for help is not an error: the command's usage on stdout, exit 0. It is read
+        // before the command runs, so `--help` never starts a run (a fuzz run, a server).
+        Some(cmd) if wants_help(&args[1..]) && is_command(cmd) => {
+            use std::io::Write as _;
+            let _ = std::io::stdout().lock().write_all(command_usage(cmd).as_bytes());
+            Ok(())
+        }
         Some("run") => cmd_run(&args[1..]),
         Some("eval" | "inspect") => cmd_eval(&args[1..]),
         Some("script") => cmd_script(&args[1..]),
@@ -94,7 +159,7 @@ fn main() -> ExitCode {
                 }
             })
         }
-        Some("recipe") => args.get(1).ok_or_else(|| USAGE.to_string()).and_then(|p| {
+        Some("recipe") => args.get(1).ok_or_else(usage).and_then(|p| {
             let v = read_json(p)?;
             recipe::to_script(&v).map(|s| println!("{}", pretty(&s)))
         }),
@@ -117,11 +182,19 @@ fn main() -> ExitCode {
         Some("bench-open") => cmd_bench_open(&args[1..]),
         // A ~1,300-body design built command by command, as an agent builds one over MCP.
         Some("bench-agent") => bench_agent::run(&args[1..]),
+        // The standard Assistant model test (#4851), run against a desktop app over its control channel.
+        Some("bench-assistant") => bench_assistant::run(&args[1..]),
         Some("--version" | "-V") => {
             println!("solidcraft-cli {}", env!("CARGO_PKG_VERSION"));
             Ok(())
         }
-        _ => Err(USAGE.to_string()),
+        // Asked-for help is not an error: usage on stdout, exit 0.
+        Some("--help" | "-h" | "help") => {
+            use std::io::Write as _;
+            let _ = std::io::stdout().lock().write_all(usage().as_bytes());
+            Ok(())
+        }
+        _ => Err(usage()),
     };
     match r {
         Ok(()) => ExitCode::SUCCESS,
@@ -136,6 +209,35 @@ fn pretty(v: &Value) -> String {
     serde_json::to_string_pretty(v).unwrap_or_default()
 }
 
+/// The whole usage: every command's lines under one `usage:` line. The lines come from the
+/// same place a command's own `--help` prints, so the two cannot drift apart.
+fn usage() -> String {
+    let mut s = String::from("usage:\n");
+    for c in COMMANDS.iter().filter(|c| c.listed) {
+        s.push_str(c.usage);
+    }
+    s.push_str(USAGE_DEBUG);
+    s
+}
+
+/// A command's own usage: its lines under a `usage:` line.
+fn command_usage(cmd: &str) -> String {
+    match COMMANDS.iter().find(|c| c.name == cmd) {
+        Some(c) => format!("usage:\n{}", c.usage),
+        None => usage(),
+    }
+}
+
+/// Whether the name is a command the CLI takes.
+fn is_command(cmd: &str) -> bool {
+    COMMANDS.iter().any(|c| c.name == cmd)
+}
+
+/// Whether the arguments ask for help.
+fn wants_help(args: &[String]) -> bool {
+    args.iter().any(|a| a == "--help" || a == "-h")
+}
+
 pub fn read_json(path: &str) -> Result<Value, String> {
     // Through the engine's file access, which refuses anything that is not a regular file and
     // reads no more than the cap: a character device or a FIFO would otherwise never end.
@@ -145,7 +247,14 @@ pub fn read_json(path: &str) -> Result<Value, String> {
 
 /// A session from a design file, a STEP/3MF/STL file, a command script, or an oracle recipe.
 pub fn load(path: &str) -> Result<Session, String> {
+    load_checked(path, solidcraft_engine::schema::ParamCheck::Off)
+}
+
+/// `load`, with scripts and recipes run at the parameter-check level `check`, which the
+/// session keeps.
+fn load_checked(path: &str, check: solidcraft_engine::schema::ParamCheck) -> Result<Session, String> {
     let mut s = Session::default();
+    s.param_check = check;
     if solidcraft_engine::io::is_step_path(path) || solidcraft_engine::io::is_mesh_path(path) {
         s.execute("doc.open", &json!({"path": path})).map_err(|e| e.to_string())?;
         return Ok(s);
@@ -155,16 +264,22 @@ pub fn load(path: &str) -> Result<Session, String> {
         let doc = solidcraft_engine::io::read_design(&bytes).map_err(|e| format!("{path}: {e}"))?;
         let mut session = Session::new(doc);
         session.path = Some(path.to_owned());
+        session.param_check = check;
         return Ok(session);
     }
     let v: Value = serde_json::from_slice(&bytes).map_err(|e| format!("{path}: {e}"))?;
     if v.get("format").and_then(Value::as_str).is_some_and(|f| solidcraft_engine::doc::format::version_of(f).is_some()) {
         s.execute("doc.open", &json!({"path": path})).map_err(|e| e.to_string())?;
-    } else if v.get("features").is_some() && v.get("commands").is_none() {
-        let script = recipe::to_script(&v)?;
-        s.run_script(&script).map_err(|e| e.to_string())?;
     } else {
-        s.run_script(&v).map_err(|e| e.to_string())?;
+        let script = if v.get("features").is_some() && v.get("commands").is_none() { recipe::to_script(&v)? } else { v };
+        // Warn level: each step's `param_warnings` as it completes, even when a later step fails
+        // (stderr, so stdout stays the caller's).
+        let mut warn = |step: usize, r: &Value| {
+            for w in r.get("param_warnings").and_then(Value::as_array).into_iter().flatten() {
+                eprintln!("{path}: step {}: {}", step + 1, w.as_str().unwrap_or_default());
+            }
+        };
+        s.run_script_each(&script, &mut warn).map_err(|e| e.to_string())?;
     }
     Ok(s)
 }
@@ -228,7 +343,7 @@ fn cmd_run(args: &[String]) -> Result<(), String> {
     let base = flag(args, "--in");
     let path = positional(args);
     if path.is_none() && base.is_none() {
-        return Err(USAGE.to_string());
+        return Err(usage());
     }
     let want_results = args.iter().any(|a| a == "--results");
     // `--profile` times each command and splits out its kernel time; it implies `--timings`.
@@ -288,13 +403,14 @@ fn open(base: Option<&str>, path: Option<&String>) -> Result<Session, String> {
         }
         (Some(b), None) => load(b),
         (None, Some(p)) => load(p),
-        (None, None) => Err(USAGE.to_string()),
+        (None, None) => Err(usage()),
     }
 }
 
 /// Refuses an option `cmd` doesn't take, and one missing its value: a typo, or another
-/// command's option, would otherwise be ignored without a word.
-fn known_flags(cmd: &str, args: &[String], valued: &[&str], switches: &[&str]) -> Result<(), String> {
+/// command's option, would otherwise be ignored without a word. `positionals` says whether the
+/// command takes a word of its own (a file, a seed): `fuzz` takes none, and would start a run.
+fn known_args(cmd: &str, args: &[String], valued: &[&str], switches: &[&str], positionals: bool) -> Result<(), String> {
     let mut i = 0;
     while let Some(a) = args.get(i) {
         if valued.contains(&a.as_str()) {
@@ -302,7 +418,9 @@ fn known_flags(cmd: &str, args: &[String], valued: &[&str], switches: &[&str]) -
                 Some(v) if !v.starts_with("--") => i += 2,
                 _ => return Err(format!("{cmd}: {a} needs a value")),
             }
-        } else if a.starts_with("--") && !switches.contains(&a.as_str()) {
+        } else if switches.contains(&a.as_str()) {
+            i += 1;
+        } else if a.starts_with("--") || !positionals {
             return Err(format!("{cmd} doesn't take {a} (it takes {})", [valued, switches].concat().join(", ")));
         } else {
             i += 1;
@@ -326,7 +444,7 @@ fn timeline_ok(s: &Session) -> Result<(), String> {
 
 fn cmd_eval(args: &[String]) -> Result<(), String> {
     let json_out = json_out(args)?;
-    let path = flag(args, "--in").or_else(|| positional(args).map(String::as_str)).ok_or_else(|| USAGE.to_string())?;
+    let path = flag(args, "--in").or_else(|| positional(args).map(String::as_str)).ok_or_else(usage)?;
     let mut s = load(path)?;
     let m = s.execute("inspect.measure", &json!({})).map_err(|e| e.to_string())?;
     let d = s.execute("document.inspect", &json!({})).map_err(|e| e.to_string())?;
@@ -344,7 +462,7 @@ fn cmd_eval(args: &[String]) -> Result<(), String> {
 /// A design's history as a command script (`timeline.export_script`): printed, or written to
 /// `--out`; what the script leaves out goes to stderr.
 fn cmd_script(args: &[String]) -> Result<(), String> {
-    let path = positional(args).ok_or_else(|| USAGE.to_string())?;
+    let path = positional(args).ok_or_else(usage)?;
     let s = &mut load(path)?;
     let out = flag(args, "--out");
     let r = s.execute("timeline.export_script", &json!({"path": out})).map_err(|e| e.to_string())?;
@@ -405,9 +523,15 @@ fn install_renderer() {
 
 fn cmd_snapshot(args: &[String]) -> Result<(), String> {
     install_renderer();
-    known_flags("snapshot", args, &["--in", "--out", "--width", "--height", "--view", "--camera"], &["--no-grid", "--no-axes"])?;
+    known_args(
+        "snapshot",
+        args,
+        &["--in", "--out", "--width", "--height", "--view", "--camera", "--body", "--tool", "--section"],
+        &["--no-grid", "--no-axes"],
+        true,
+    )?;
     if positional(args).is_none() && flag(args, "--in").is_none() {
-        return Err(USAGE.to_string());
+        return Err(usage());
     }
     let out = flag(args, "--out").ok_or("snapshot needs --out FILE.png")?;
     let size = |name: &str, default: u32| match flag(args, name) {
@@ -416,6 +540,9 @@ fn cmd_snapshot(args: &[String]) -> Result<(), String> {
     };
     let (w, h) = (size("--width", 1280)?, size("--height", 800)?);
     let mut s = open(flag(args, "--in"), positional(args))?;
+    // How the bodies are drawn and where the model is cut, through the commands the app's
+    // Appearance dialog and Section Analysis run (`preview`).
+    preview::apply(&mut s, &flags(args, "--body"), &flags(args, "--tool"), flag(args, "--section"))?;
     // The camera choices of the MCP `screenshot`, through the same command (`view.apply`): a
     // standard view, a view saved in the design, or an explicit camera. A script that applies a
     // view itself sets the camera too; without any, the iso view framing the model.
@@ -488,7 +615,7 @@ fn ico(images: &[(usize, Vec<u8>)]) -> Result<Vec<u8>, String> {
 
 fn cmd_exec(args: &[String]) -> Result<(), String> {
     install_renderer();
-    let id = args.first().ok_or_else(|| USAGE.to_string())?;
+    let id = args.first().ok_or_else(usage)?;
     let p: Value = match args.get(1) {
         Some(t) => serde_json::from_str(t).map_err(|e| format!("params: {e}"))?,
         None => json!({}),
@@ -499,10 +626,27 @@ fn cmd_exec(args: &[String]) -> Result<(), String> {
     Ok(())
 }
 
+/// `mcp setup`: add the server to each installed AI client, with this program's own path.
+fn cmd_mcp_setup(args: &[String]) -> Result<(), String> {
+    use solidcraft_engine::agent_setup as setup;
+    let (lines, ok) = setup::setup(args, &setup::Env::from_process(), &setup::current_exe()?)?;
+    for l in lines {
+        println!("{l}");
+    }
+    if ok { Ok(()) } else { Err("mcp setup: some clients could not be configured".into()) }
+}
+
 /// MCP server on stdio: headless (optionally starting from a design or script) or bridged to
 /// a running app's control port. stdout carries only protocol messages. Files the agent's tool
 /// calls reach are confined to `solidcraft_mcp::agent_scope` unless `--allow-any-path` is given.
 fn cmd_mcp(args: &[String]) -> Result<(), String> {
+    if matches!(args.first().map(String::as_str), Some("setup" | "install")) {
+        return cmd_mcp_setup(&args[1..]);
+    }
+    let render_gpu = args.iter().any(|arg| arg == "--render-gpu");
+    if render_gpu && flag(args, "--connect").is_some() {
+        return Err("mcp: --render-gpu installs a headless image host; a connected application owns its own device".into());
+    }
     install_renderer();
     let scope = (!args.iter().any(|a| a == "--allow-any-path"))
         .then(|| solidcraft_mcp::agent_scope(flags(args, "--allow-path").into_iter().map(std::path::PathBuf::from)));
@@ -519,6 +663,17 @@ fn cmd_mcp(args: &[String]) -> Result<(), String> {
             eprintln!("solidcraft mcp: the design's folder is left out because {why}; add it with --allow-path if you mean it");
         }
     }
+    // How a headless session treats calls that break a command's parameter contract (docs/mcp.md).
+    let param_check = match flag(args, "--param-check") {
+        None if args.iter().any(|a| a == "--param-check") => return Err("mcp: --param-check wants off, warn or strict".into()),
+        None => solidcraft_engine::schema::ParamCheck::Off,
+        Some(v) => {
+            solidcraft_engine::schema::ParamCheck::parse(v).ok_or_else(|| format!("mcp: --param-check wants off, warn or strict, not `{v}`"))?
+        }
+    };
+    if param_check != solidcraft_engine::schema::ParamCheck::Off && flag(args, "--connect").is_some() {
+        eprintln!("solidcraft mcp: --param-check applies to headless sessions; calls to the app are not checked yet");
+    }
     let backend: Box<dyn solidcraft_mcp::Backend> = match (flag(args, "--connect"), flag(args, "--in")) {
         (Some(_), Some(_)) => return Err("mcp: use either --connect or --in, not both".into()),
         (Some(addr), None) => {
@@ -535,14 +690,49 @@ fn cmd_mcp(args: &[String]) -> Result<(), String> {
             }
             Box::new(remote)
         }
-        (None, Some(path)) => Box::new(solidcraft_mcp::Headless::new(load(path)?)),
-        (None, None) => Box::new(solidcraft_mcp::Headless::default()),
+        (None, Some(path)) => {
+            let mut headless = solidcraft_mcp::Headless::new(load_checked(path, param_check)?);
+            if render_gpu {
+                headless.session.register_render_job_host(solidcraft_gpu::path::host().map_err(|e| e.to_string())?).map_err(|e| e.to_string())?;
+            }
+            Box::new(headless)
+        }
+        (None, None) => {
+            let auto = !args.iter().any(|a| a == "--headless");
+            if auto && let Some(port) = discover_app() {
+                eprintln!("solidcraft mcp: bridged to the running app at 127.0.0.1:{port} (--headless starts a session of its own)");
+                return serve_mcp(Box::new(solidcraft_mcp::Remote::new(&format!("127.0.0.1:{port}"), flag(args, "--token"))), scope);
+            }
+            let mut headless = solidcraft_mcp::Headless::default();
+            headless.session.param_check = param_check;
+            if render_gpu {
+                headless.session.register_render_job_host(solidcraft_gpu::path::host().map_err(|e| e.to_string())?).map_err(|e| e.to_string())?;
+            }
+            if auto {
+                // The app may start after the agent: look for it again until there is work here.
+                Box::new(solidcraft_mcp::Auto::new(headless, Box::new(discover_app), flag(args, "--token")))
+            } else {
+                Box::new(headless)
+            }
+        }
     };
+    serve_mcp(backend, scope)
+}
+
+fn serve_mcp(backend: Box<dyn solidcraft_mcp::Backend>, scope: Option<solidcraft_engine::io::vfs::PathScope>) -> Result<(), String> {
     let stdin = std::io::stdin();
     let stdout = std::io::stdout();
     solidcraft_mcp::Server::new(backend).with_path_scope(scope).serve(stdin.lock(), stdout.lock()).map_err(|e| e.to_string())
 }
 
+/// The port of the running desktop app: the one its discovery file names, if something listens
+/// there (a file left by an app that crashed names a closed port).
+fn discover_app() -> Option<u16> {
+    let port = solidcraft_engine::control_auth::read_current_port()?;
+    let addr = std::net::SocketAddr::from(([127, 0, 0, 1], port));
+    std::net::TcpStream::connect_timeout(&addr, std::time::Duration::from_millis(500)).ok().map(|_| port)
+}
+
 /// `save-stress <path> <rounds>`: save a design of a few hundred kilobytes `rounds` times, its
 /// parameter `save_round` set to the round number each time.
 fn cmd_save_stress(args: &[String]) -> Result<(), String> {
@@ -595,6 +785,36 @@ fn cmd_bench_edit(args: &[String]) -> Result<(), String> {
     Ok(())
 }
 
+/// `bench-open --ops`: each command of `script` (a JSON array of `{command, params}`), then its
+/// undo, each timed as the command and the view it leaves (the placed model, its meshes warmed
+/// as the desktop does after a change).
+fn bench_ops(mut s: Session, script: &str) -> Result<Session, String> {
+    let text = std::fs::read_to_string(script).map_err(|e| format!("{script}: {e}"))?;
+    let ops: Value = serde_json::from_str(&text).map_err(|e| format!("{script}: {e}"))?;
+    let ops = ops.as_array().ok_or("--ops: a JSON array of {command, params}")?;
+    let time = |s: &mut Session, id: &str, p: &Value| -> Result<Value, String> {
+        let t = std::time::Instant::now();
+        let r = s.execute(id, p).map_err(|e| format!("{id}: {e}"))?;
+        let ms = t.elapsed().as_secs_f64() * 1000.0;
+        let t = std::time::Instant::now();
+        s.world_state().warm_meshes(|| true);
+        let view_ms = t.elapsed().as_secs_f64() * 1000.0;
+        println!("{}", json!({"step": "op", "command": id, "ms": ms, "view_ms": view_ms}));
+        Ok(r)
+    };
+    for op in ops {
+        let id = op.get("command").and_then(Value::as_str).ok_or("--ops: each step needs a `command`")?;
+        let p = op.get("params").cloned().unwrap_or(Value::Null);
+        let steps = s.undo.len();
+        time(&mut s, id, &p)?;
+        // Commands that are no undo step (showing and hiding) have nothing to undo.
+        if op.get("undo").and_then(Value::as_bool) != Some(false) && s.undo.len() > steps {
+            time(&mut s, "edit.undo", &json!({}))?;
+        }
+    }
+    Ok(s)
+}
+
 /// Separate file reading, JSON decoding/repair, timeline evaluation and display meshing.
 pub(crate) fn cmd_bench_open(args: &[String]) -> Result<(), String> {
     let path = args.first().ok_or("usage: solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only]")?;
@@ -607,37 +827,84 @@ pub(crate) fn cmd_bench_open(args: &[String]) -> Result<(), String> {
     let t = std::time::Instant::now();
     // The file as read, held until the timeline has evaluated it (as the import command does).
     let mut read = None;
-    let doc = if step {
+    let (doc, saved) = if step {
         let imported = solidcraft_engine::io::step_import_feature(&bytes, path).map_err(|e| e.to_string())?;
         let mut doc = solidcraft_engine::doc::Document::new(&imported.name);
         doc.add_feature(imported.kind, Some(&imported.name)).map_err(|e| e.to_string())?;
         read = Some(imported.import);
-        doc
+        (doc, None)
     } else {
-        solidcraft_engine::io::read_design(&bytes).map_err(|e| e.to_string())?
+        // As Open reads it: with the model the file keeps.
+        solidcraft_engine::io::read_design_file(path, None::<fn(solidcraft_engine::io::DesignPreview)>).map_err(|e| e.to_string())?
     };
     let parse_ms = t.elapsed().as_secs_f64() * 1000.0;
-    println!("{}", json!({"step": "parse", "ms": parse_ms, "features": doc.features.len()}));
+    println!("{}", json!({"step": "parse", "ms": parse_ms, "features": doc.features.len(), "saved_model": saved.is_some()}));
     if args.iter().any(|a| a == "--parse-only") {
         return Ok(());
     }
     let t = std::time::Instant::now();
-    let s = Session::new(doc);
+    let s = Session::opened(doc, saved.as_ref());
     drop(read);
-    println!("{}", json!({"step": "evaluate", "ms": t.elapsed().as_secs_f64() * 1000.0}));
+    // Taken from the file: nothing evaluated (SOLIDCRAFT_NO_MODEL_CACHE evaluates anyway), or
+    // only the features whose state a thinned file left out.
+    let adopted = saved.is_some() && s.model.last_recomputed == 0;
+    println!("{}", json!({"step": "evaluate", "ms": t.elapsed().as_secs_f64() * 1000.0, "adopted": adopted, "recomputed": s.model.last_recomputed}));
     for r in &s.model.results {
         println!("{}", json!({"step": "feature", "id": r.id, "name": r.name, "ms": r.ms, "error": r.error}));
     }
     let t = std::time::Instant::now();
     let st = s.world_state();
+    let place_ms = t.elapsed().as_secs_f64() * 1000.0;
     // As the desktop app prepares a design it opened.
     st.warm_meshes(|| true);
     let triangles: usize = st.bodies.iter().map(|b| b.mesh().triangles.len()).sum();
-    println!("{}", json!({"step": "mesh", "ms": t.elapsed().as_secs_f64() * 1000.0, "bodies": st.bodies.len(), "triangles": triangles}));
+    println!(
+        "{}",
+        json!({"step": "mesh", "ms": t.elapsed().as_secs_f64() * 1000.0, "place_ms": place_ms, "bodies": st.bodies.len(), "triangles": triangles})
+    );
+    let flag = |name: &str| args.iter().position(|a| a == name);
+    // `--save PATH`: save the opened design without its model cache (to PATH.plain.solidcraft) and
+    // as the app does, with it, then read the cache back.
+    let s = match flag("--save").and_then(|i| args.get(i + 1)) {
+        Some(out) => {
+            let mut s = s;
+            // Without the cache first, for comparison.
+            let plain = format!("{out}.plain.solidcraft");
+            let t = std::time::Instant::now();
+            s.execute("file.save_as", &json!({"path": plain, "cache": false})).map_err(|e| e.to_string())?;
+            let plain_ms = t.elapsed().as_secs_f64() * 1000.0;
+            let plain_bytes = std::fs::metadata(&plain).map(|m| m.len()).unwrap_or(0);
+            let t = std::time::Instant::now();
+            s.execute("file.save_as", &json!({"path": out})).map_err(|e| e.to_string())?;
+            let save_ms = t.elapsed().as_secs_f64() * 1000.0;
+            let bytes = std::fs::read(out).map_err(|e| format!("{out}: {e}"))?;
+            let t = std::time::Instant::now();
+            let cached = solidcraft_engine::io::read_design_geometry(&bytes).map(|m| m.bodies.len());
+            let read_ms = t.elapsed().as_secs_f64() * 1000.0;
+            // Why bodies could not be kept exactly, when the cache was left out.
+            let mut refused = std::collections::BTreeMap::<String, usize>::new();
+            if cached.is_none() {
+                for b in &s.model.state().bodies {
+                    if let Err(e) = solidcraft_engine::kernel::encode_native_body(&b.body) {
+                        *refused.entry(e.to_string()).or_default() += 1;
+                    }
+                }
+            }
+            println!(
+                "{}",
+                json!({"step": "save", "ms": save_ms, "bytes": bytes.len(), "plain_ms": plain_ms, "plain_bytes": plain_bytes, "cached_bodies": cached, "cache_read_ms": read_ms, "refused": refused})
+            );
+            s
+        }
+        None => s,
+    };
     // `--display LEVEL`: the display plans the viewport draws at that display quality, made as
     // the GPU viewport makes them; `--edit NAME EXPR` then changes a parameter and times the
     // evaluation and the plans of the bodies it changed.
-    let flag = |name: &str| args.iter().position(|a| a == name);
+    let s = match flag("--ops").and_then(|i| args.get(i + 1)) {
+        Some(ops) => bench_ops(s, ops)?,
+        None => s,
+    };
     let Some(level) = flag("--display").and_then(|i| args.get(i + 1)) else { return Ok(()) };
     let q = solidcraft_engine::doc::display_quality::DisplayQuality::parse(level).ok_or("--display: coarse, normal, fine or ultra")?;
     let plans = |st: &solidcraft_engine::doc::ModelState| {

apps/solidcraft-cli/src/preview.rs

@@ -0,0 +1,286 @@
+//! What a `snapshot` draws see-through, what it draws in a colour of its own, and where it cuts
+//! the model: the `--body`, `--tool` and `--section` options.
+//!
+//! None of this is a renderer of its own. Each option turns into the command the app itself runs
+//! — `appearance.assign` for the Appearance dialog, `inspect.section` for Section Analysis — so
+//! a picture of a tool body inside a translucent target is the picture the window would show
+//! with the same appearances assigned, and a script can do the same thing without the options.
+
+use serde_json::{Value, json};
+use solidcraft_engine::Session;
+
+/// How see-through the bodies around a `--tool` are drawn: enough to read the tool through them,
+/// solid enough to keep the shape of the material it meets.
+pub const TARGET_OPACITY: f64 = 0.3;
+
+/// A `--tool` body's colour: the hue the viewport's feature preview uses for removed material,
+/// so a cut's tool looks in a picture the way the preview looks in the window.
+pub const TOOL_COLOR: &str = "#e8542c";
+
+/// The colour of a body with no appearance of its own ([`solidcraft_engine::view::colors::BODY`]),
+/// as `appearance.assign` takes it. Giving a body an opacity means giving it a look, and a look
+/// carries a colour: this keeps the one it is already drawn in.
+fn default_body_hex() -> String {
+    let c = solidcraft_engine::view::colors::BODY;
+    format!("#{:02x}{:02x}{:02x}", c.0, c.1, c.2)
+}
+
+/// How one body is drawn: `--body NAME:opacity=0.3,color=#cc3333`. Either key alone is enough;
+/// the other keeps what the design already says.
+#[derive(Debug, PartialEq)]
+pub struct BodyLook {
+    pub name: String,
+    pub opacity: Option<f64>,
+    pub color: Option<String>,
+}
+
+/// `NAME:key=value[,key=value]`, or `NAME` on its own (which says nothing and is an error:
+/// a body is named here to change how it is drawn).
+pub fn parse_body(spec: &str) -> Result<BodyLook, String> {
+    let (name, rest) = spec
+        .split_once(':')
+        .ok_or_else(|| format!("--body `{spec}` must be NAME:key=value (`Target:opacity=0.3`, `Tool:color=#cc3333`, keys separated by commas)"))?;
+    let name = name.trim();
+    if name.is_empty() {
+        return Err(format!("--body `{spec}` names no body"));
+    }
+    let mut look = BodyLook { name: name.to_owned(), opacity: None, color: None };
+    for part in rest.split(',') {
+        let part = part.trim();
+        if part.is_empty() {
+            continue;
+        }
+        let (key, value) = part.split_once('=').ok_or_else(|| format!("--body {name}: `{part}` must be key=value (opacity, color)"))?;
+        let value = value.trim();
+        match key.trim().to_ascii_lowercase().as_str() {
+            "opacity" => {
+                let o: f64 = value.parse().map_err(|_| format!("--body {name}: opacity must be a number 0 to 1, not `{value}`"))?;
+                if !o.is_finite() || !(0.0..=1.0).contains(&o) {
+                    return Err(format!("--body {name}: opacity must be 0 to 1, not `{value}`"));
+                }
+                look.opacity = Some(o);
+            }
+            "color" => {
+                let digits = value.strip_prefix('#').filter(|h| h.len() == 6 && h.chars().all(|c| c.is_ascii_hexdigit()));
+                let digits = digits.ok_or_else(|| format!("--body {name}: color must be #rrggbb, not `{value}`"))?;
+                look.color = Some(format!("#{}", digits.to_ascii_lowercase()));
+            }
+            other => return Err(format!("--body {name}: unknown key `{other}` (opacity, color)")),
+        }
+    }
+    if look.opacity.is_none() && look.color.is_none() {
+        return Err(format!("--body `{spec}` asks for nothing: give opacity, color, or both"));
+    }
+    Ok(look)
+}
+
+/// The `inspect.section` parameters a `--section` spec asks for: `z=27` (the plane through that
+/// world coordinate, its normal along +Z), `XY` (a named plane through the origin), either with
+/// `,flip` to keep the other side, or the command's own JSON object.
+pub fn parse_section(spec: &str) -> Result<Value, String> {
+    let spec = spec.trim();
+    if spec.starts_with('{') {
+        return serde_json::from_str(spec).map_err(|e| format!("--section: not JSON: {e}"));
+    }
+    let mut parts = spec.split(',').map(str::trim);
+    let plane = parts.next().unwrap_or_default();
+    let mut flip = false;
+    for p in parts {
+        match p.to_ascii_lowercase().as_str() {
+            "" => {}
+            "flip" => flip = true,
+            other => return Err(format!("--section: unknown `{other}` (only `flip` follows the plane)")),
+        }
+    }
+    // A named plane through the world origin, as `inspect.section` takes it.
+    let mut params = match plane.to_ascii_uppercase().as_str() {
+        p @ ("XY" | "XZ" | "YZ") => json!({"plane": p}),
+        _ => {
+            // AXIS=VALUE: the plane whose normal is that axis, cutting at that world coordinate.
+            let (axis, at) = plane.split_once('=').ok_or_else(|| {
+                format!("--section `{spec}` must be z=27 (a world coordinate on an axis), XY, XZ, YZ, or the JSON inspect.section takes")
+            })?;
+            let at: f64 = at.trim().parse().map_err(|_| format!("--section {axis}: `{}` is not a number", at.trim()))?;
+            if !at.is_finite() {
+                return Err(format!("--section {axis}: `{at}` is not a finite coordinate"));
+            }
+            // The plane normal to each axis: Z is XY, Y is XZ, X is YZ.
+            let named = match axis.trim().to_ascii_lowercase().as_str() {
+                "x" => "YZ",
+                "y" => "XZ",
+                "z" => "XY",
+                other => return Err(format!("--section: unknown axis `{other}` (x, y or z)")),
+            };
+            json!({"plane": named, "at": at})
+        }
+    };
+    if flip {
+        params["flip"] = json!(true);
+    }
+    Ok(params)
+}
+
+/// The design's body names, for an error that says which ones there are.
+fn body_names(s: &Session) -> Vec<String> {
+    s.model.state().bodies.iter().map(|b| b.name.clone()).collect()
+}
+
+/// The colour and opacity a body is drawn with now, as `appearance.assign` takes them: its own
+/// appearance, else its component's or material's, else the default body colour.
+fn current_look(s: &mut Session, name: &str) -> Result<(String, f64), String> {
+    let reply = s.execute("appearance.list", &json!({"body": name})).map_err(|e| e.to_string())?;
+    let body = reply.get("body");
+    let look = body.and_then(|b| b.get("appearance")).filter(|a| !a.is_null());
+    let hex = look
+        .and_then(|a| a.get("color"))
+        .and_then(Value::as_str)
+        .map(str::to_owned)
+        // No appearance, but an imported colour: `body.color` is that colour, 0..1 per channel.
+        .or_else(|| {
+            let c = body?.get("color")?.as_array()?;
+            let ch = |i: usize| -> Option<u8> { Some((c.get(i)?.as_f64()?.clamp(0.0, 1.0) * 255.0).round() as u8) };
+            Some(format!("#{:02x}{:02x}{:02x}", ch(0)?, ch(1)?, ch(2)?))
+        })
+        .unwrap_or_else(default_body_hex);
+    let opacity = look.and_then(|a| a.get("opacity")).and_then(Value::as_f64).filter(|o| o.is_finite()).unwrap_or(1.0);
+    Ok((hex, opacity))
+}
+
+/// Draw `name` with `look`, keeping whichever of colour and opacity it does not give.
+fn assign(s: &mut Session, look: &BodyLook) -> Result<(), String> {
+    let name = &look.name;
+    if !body_names(s).iter().any(|b| b == name) {
+        return Err(format!("no body `{name}` in the design (it has {})", body_list(s)));
+    }
+    let (hex, opacity) = current_look(s, name)?;
+    let params = json!({
+        "bodies": [name],
+        "color": look.color.clone().unwrap_or(hex),
+        "opacity": look.opacity.unwrap_or(opacity),
+    });
+    s.execute("appearance.assign", &params).map(|_| ()).map_err(|e| format!("drawing `{name}`: {e}"))
+}
+
+/// The design's bodies, named, for an error message.
+fn body_list(s: &Session) -> String {
+    let names = body_names(s);
+    if names.is_empty() { "no bodies".to_owned() } else { names.join(", ") }
+}
+
+/// Apply the options to the session, in the order a later one overrides an earlier: the `--tool`
+/// preview first (it speaks for every body), then each `--body`, then the section.
+pub fn apply(s: &mut Session, bodies: &[&str], tools: &[&str], section: Option<&str>) -> Result<(), String> {
+    // Everything is read before anything is drawn, so a misspelt option is an error rather than
+    // half a picture.
+    let looks: Vec<BodyLook> = bodies.iter().map(|spec| parse_body(spec)).collect::<Result<_, _>>()?;
+    let section = section.map(parse_section).transpose()?;
+    if !tools.is_empty() {
+        let names = body_names(s);
+        for t in tools {
+            if !names.iter().any(|b| b == t) {
+                return Err(format!("--tool: no body `{t}` in the design (it has {})", body_list(s)));
+            }
+        }
+        // Everything but the tool see-through, in the colour it already has, so the tool reads
+        // against the material it meets. Bodies that share a colour are assigned together: a
+        // design of many bodies then costs a command or two rather than one for each.
+        let mut around: std::collections::BTreeMap<String, Vec<String>> = std::collections::BTreeMap::new();
+        for name in names.iter().filter(|n| !tools.contains(&n.as_str())) {
+            around.entry(current_look(s, name)?.0).or_default().push(name.clone());
+        }
+        for (hex, sharing_it) in around {
+            let params = json!({"bodies": sharing_it, "color": hex, "opacity": TARGET_OPACITY});
+            s.execute("appearance.assign", &params).map_err(|e| format!("--tool: {e}"))?;
+        }
+        // Then the tool itself, solid in the tool colour.
+        let params = json!({"bodies": tools, "color": TOOL_COLOR, "opacity": 1.0});
+        s.execute("appearance.assign", &params).map_err(|e| format!("--tool: {e}"))?;
+    }
+    for look in &looks {
+        assign(s, look)?;
+    }
+    if let Some(params) = section {
+        s.execute("inspect.section", &params).map_err(|e| format!("--section: {e}"))?;
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// `--body` names a body and says how it is drawn. Either key alone is enough.
+    #[test]
+    fn a_body_spec_is_a_name_and_the_keys_appearance_assign_takes() {
+        let look = |s: &str| parse_body(s).unwrap();
+        assert_eq!(look("Target:opacity=0.3"), BodyLook { name: "Target".into(), opacity: Some(0.3), color: None });
+        assert_eq!(look("Tool:color=#CC3333"), BodyLook { name: "Tool".into(), opacity: None, color: Some("#cc3333".into()) });
+        assert_eq!(look("Tool: opacity = 1 , color = #00ff00 "), BodyLook { name: "Tool".into(), opacity: Some(1.0), color: Some("#00ff00".into()) });
+        // A body name with a space in it, as the browser shows them.
+        assert_eq!(look("Bracket arm:opacity=0").name, "Bracket arm");
+        assert_eq!(look("A:opacity=0").opacity, Some(0.0));
+    }
+
+    /// Every way of getting `--body` wrong is an error that says what it takes, never a panic
+    /// and never a silently ignored option.
+    #[test]
+    fn a_bad_body_spec_says_what_it_takes() {
+        for (spec, expect) in [
+            ("Target", "NAME:key=value"),
+            (":opacity=0.3", "names no body"),
+            ("Target:", "asks for nothing"),
+            ("Target:opacity", "key=value"),
+            ("Target:opacity=high", "0 to 1"),
+            ("Target:opacity=1.5", "0 to 1"),
+            ("Target:opacity=-0.2", "0 to 1"),
+            ("Target:opacity=NaN", "0 to 1"),
+            ("Target:opacity=inf", "0 to 1"),
+            ("Target:color=red", "#rrggbb"),
+            ("Target:color=#ccc", "#rrggbb"),
+            ("Target:color=#gggggg", "#rrggbb"),
+            ("Target:alpha=0.3", "unknown key `alpha`"),
+        ] {
+            let e = parse_body(spec).err().unwrap_or_else(|| panic!("{spec} was accepted"));
+            assert!(e.contains(expect), "{spec}: {e}");
+        }
+    }
+
+    /// A `--section` spec is the plane `inspect.section` cuts with: an axis and a world
+    /// coordinate, a named plane, `flip` for the other side, or the command's own JSON.
+    #[test]
+    fn a_section_spec_is_the_plane_inspect_section_takes() {
+        let p = |s: &str| parse_section(s).unwrap();
+        // The plane normal to each axis, cutting at that coordinate.
+        assert_eq!(p("z=27"), json!({"plane": "XY", "at": 27.0}));
+        assert_eq!(p("y=-5.5"), json!({"plane": "XZ", "at": -5.5}));
+        assert_eq!(p("X=0"), json!({"plane": "YZ", "at": 0.0}));
+        assert_eq!(p("z=27,flip"), json!({"plane": "XY", "at": 27.0, "flip": true}));
+        // A named plane through the origin, and the command's own parameters.
+        assert_eq!(p("XY"), json!({"plane": "XY"}));
+        assert_eq!(p("yz,flip"), json!({"plane": "YZ", "flip": true}));
+        assert_eq!(p("{\"plane\": \"XY\", \"offset\": 4}"), json!({"plane": "XY", "offset": 4}));
+    }
+
+    #[test]
+    fn a_bad_section_spec_says_what_it_takes() {
+        for (spec, expect) in [
+            ("27", "z=27"),
+            ("w=4", "unknown axis `w`"),
+            ("z=high", "is not a number"),
+            ("z=inf", "not a finite coordinate"),
+            ("z=27,upside-down", "unknown `upside-down`"),
+            ("{\"plane\":", "not JSON"),
+        ] {
+            let e = parse_section(spec).err().unwrap_or_else(|| panic!("{spec} was accepted"));
+            assert!(e.contains(expect), "{spec}: {e}");
+        }
+    }
+
+    /// The tool colour is the one the options document, in the form `appearance.assign` takes.
+    #[test]
+    fn the_tool_colour_is_a_hex_colour_the_command_takes() {
+        assert_eq!(parse_body(&format!("Tool:color={TOOL_COLOR}")).unwrap().color, Some(TOOL_COLOR.to_owned()));
+        assert!((0.0..1.0).contains(&TARGET_OPACITY), "a target must be see-through: {TARGET_OPACITY}");
+        assert_eq!(default_body_hex(), "#b0bac6");
+    }
+}

apps/solidcraft-cli/src/render.rs

@@ -1,25 +1,89 @@
 //! Complete headless image-job workflow through the same engine commands as the UI/MCP.
-use serde_json::json;
+use serde_json::{Value, json};
 use solidcraft_engine::{
-    doc::render_settings::RenderSetup,
-    render::job::{CpuHost, JobId, Phase},
+    Session,
+    doc::render_settings::{RenderJob, RenderSetup},
+    render::job::{CpuHost, JobId, Phase, ToneMap},
 };
 
+/// Only explicit runtime CLI flags are stored here. A typed setup owns these
+/// values even when a supplied flag happens to match the saved value.
+#[derive(Default)]
+struct RuntimeOptions {
+    progressive: bool,
+    transparent: bool,
+    samples: Option<u32>,
+    max_depth: Option<u32>,
+    seed: Option<u32>,
+    lighting: Option<String>,
+    tone_map: Option<ToneMap>,
+    environment: Option<String>,
+}
+
+impl RuntimeOptions {
+    fn explicit_flag(&self) -> Option<&'static str> {
+        [
+            (self.progressive, "--progressive"),
+            (self.transparent, "--transparent"),
+            (self.samples.is_some(), "--samples"),
+            (self.max_depth.is_some(), "--max-depth"),
+            (self.seed.is_some(), "--seed"),
+            (self.lighting.is_some(), "--lighting"),
+            (self.tone_map.is_some(), "--tone-map"),
+            (self.environment.is_some(), "--environment"),
+        ]
+        .into_iter()
+        .find_map(|(present, flag)| present.then_some(flag))
+    }
+
+    fn request(&self, session: &Session, settings: RenderSetup) -> Result<(Value, bool), String> {
+        if let Some(job) = &settings.job {
+            if let Some(flag) = self.explicit_flag() {
+                return Err(format!("{flag} cannot accompany a typed saved render setup; change the saved job options instead"));
+            }
+            settings.validate().map_err(|e| e.to_string())?;
+            session.doc.render.validate_resources(&settings).map_err(|e| e.to_string())?;
+            let needs_gpu = matches!(job, RenderJob::GpuPath { .. });
+            return Ok((json!({"settings":settings}), needs_gpu));
+        }
+        // Legacy setups and unnamed requests retain their runtime wire contract.
+        settings.validate().map_err(|e| e.to_string())?;
+        let mut params = json!({"settings":settings,"transparent_background":self.transparent,
+            "progressive":self.progressive,"samples":self.samples,"max_depth":self.max_depth,"seed":self.seed});
+        if let Some(path) = &self.lighting {
+            let text = solidcraft_engine::io::vfs::read_to_string(path, 65536).map_err(|e| format!("could not read lighting: {e}"))?;
+            let lighting: solidcraft_engine::render::job::StudioLighting = serde_json::from_str(&text).map_err(|e| e.to_string())?;
+            params["lighting"] = json!(lighting);
+        }
+        if let Some(tone_map) = self.tone_map {
+            params["tone_map"] = json!(tone_map);
+        }
+        if let Some(path) = &self.environment {
+            let text = solidcraft_engine::io::vfs::read_to_string(path, 65536).map_err(|e| format!("could not read environment: {e}"))?;
+            params["environment"] = serde_json::from_str(&text).map_err(|e| e.to_string())?;
+        }
+        Ok((params, self.progressive))
+    }
+}
+
 pub fn run(args: &[String]) -> Result<(), String> {
     let input = args.first().filter(|p| !p.starts_with('-')).ok_or("render requires an input design or script")?;
     let mut out = None;
     let mut setup = None;
     let mut width = None;
     let mut height = None;
-    let mut transparent = false;
+    let mut exposure = None;
+    let mut runtime = RuntimeOptions::default();
     let mut overwrite = false;
     let mut timeout = 120u64;
     let mut i = 1;
     while let Some(arg) = args.get(i) {
         match arg.as_str() {
-            "--transparent" => transparent = true,
+            "--progressive" => runtime.progressive = true,
+            "--transparent" => runtime.transparent = true,
             "--overwrite" => overwrite = true,
-            "--out" | "--setup" | "--width" | "--height" | "--timeout" => {
+            "--out" | "--setup" | "--width" | "--height" | "--timeout" | "--samples" | "--max-depth" | "--seed" | "--exposure" | "--lighting"
+            | "--tone-map" | "--environment" => {
                 i += 1;
                 let value = args.get(i).ok_or_else(|| format!("missing value for {arg}"))?;
                 match arg.as_str() {
@@ -27,6 +91,20 @@ pub fn run(args: &[String]) -> Result<(), String> {
                     "--setup" => setup = Some(value.clone()),
                     "--width" => width = Some(value.parse::<u32>().map_err(|_| "invalid width")?),
                     "--height" => height = Some(value.parse::<u32>().map_err(|_| "invalid height")?),
+                    "--samples" => runtime.samples = Some(value.parse::<u32>().map_err(|_| "invalid samples")?),
+                    "--max-depth" => runtime.max_depth = Some(value.parse::<u32>().map_err(|_| "invalid depth")?),
+                    "--seed" => runtime.seed = Some(value.parse::<u32>().map_err(|_| "invalid seed")?),
+                    "--exposure" => exposure = Some(value.parse::<f64>().map_err(|_| "invalid exposure")?),
+                    // Defer file reads until a saved job has rejected conflicting controls.
+                    "--environment" => runtime.environment = Some(value.clone()),
+                    "--lighting" => runtime.lighting = Some(value.clone()),
+                    "--tone-map" => {
+                        runtime.tone_map = Some(match value.as_str() {
+                            "reinhard" => ToneMap::Reinhard,
+                            "aces_fitted" => ToneMap::AcesFitted,
+                            _ => return Err("tone-map must be reinhard or aces_fitted".into()),
+                        })
+                    }
                     _ => timeout = value.parse::<u64>().map_err(|_| "invalid timeout")?,
                 }
             }
@@ -39,18 +117,10 @@ pub fn run(args: &[String]) -> Result<(), String> {
     }
     let out = out.ok_or("render requires --out FILE.png")?;
     let mut session = crate::load(input)?;
-    session.set_render_job_host(Some(CpuHost::for_platform().map_err(|e| e.to_string())?)).map_err(|e| e.to_string())?;
-    session.execute("render.scene", &json!({})).map_err(|e| e.to_string())?;
-    let mut settings = if let Some(name) = setup {
-        session.doc.render.setups.get(&name).cloned().ok_or("no saved render setup with that name")?
+    let mut settings = if let Some(name) = setup.as_deref() {
+        session.doc.render.setups.get(name).cloned().ok_or("no saved render setup with that name")?
     } else {
-        let mut settings = RenderSetup::default();
-        if let Some(camera) = session.camera {
-            settings.camera = camera;
-        } else {
-            settings.camera.fit(&solidcraft_engine::product_scene::extract(&session).map_err(|e| e.to_string())?.bounds);
-        }
-        settings
+        RenderSetup::default()
     };
     if let Some(width) = width {
         settings.width = width;
@@ -58,7 +128,27 @@ pub fn run(args: &[String]) -> Result<(), String> {
     if let Some(height) = height {
         settings.height = height;
     }
-    let params = json!({"settings":settings,"transparent_background":transparent});
+    if let Some(exposure) = exposure {
+        settings.exposure_ev = exposure;
+    }
+    // Resolve saved intent before opening a GPU or explicitly settling geometry.
+    // Width/height/exposure only change this validated inline settings clone.
+    let (mut params, needs_gpu) = runtime.request(&session, settings)?;
+    session.set_render_job_host(Some(CpuHost::for_platform().map_err(|e| e.to_string())?)).map_err(|e| e.to_string())?;
+    if needs_gpu {
+        session.register_render_job_host(solidcraft_gpu::path::host().map_err(|e| e.to_string())?).map_err(|e| e.to_string())?;
+    }
+    session.execute("render.scene", &json!({})).map_err(|e| e.to_string())?;
+    if setup.is_none() {
+        let camera = if let Some(camera) = session.camera {
+            camera
+        } else {
+            let mut camera = RenderSetup::default().camera;
+            camera.fit(&solidcraft_engine::product_scene::extract(&session).map_err(|e| e.to_string())?.bounds);
+            camera
+        };
+        params["settings"]["camera"] = json!(camera);
+    }
     let preflight = session.execute("render.preflight", &params).map_err(|e| e.to_string())?;
     let started = session.execute("render.start", &params).map_err(|e| e.to_string())?;
     let id: JobId = serde_json::from_value(started["job"].clone()).map_err(|e| e.to_string())?;

apps/solidcraft-cli/tests/action_matrix.rs

@@ -350,7 +350,7 @@ fn actions(s: &Session) -> Vec<Action> {
         // The surface's normal at `p` (either way round): exact on analytic faces.
         let normal_at = |f: u32, p: Vec3| -> Option<Vec3> {
             match face_surface(&b.body, f as usize) {
-                Some(FaceSurface::Plane { normal, .. }) => Some(normal),
+                Some(FaceSurface::Plane { normal, .. }) => Some(*normal),
                 Some(FaceSurface::Cylinder { origin, axis, .. }) => {
                     let v = p - origin;
                     (v - axis * v.dot(axis)).normalized()
@@ -1412,7 +1412,7 @@ fn a_sketch_on_a_patterned_boss_top() {
 fn construction_geometry_and_holes_on_a_moved_component() {
     let moved = || {
         vec![
-            json!({"command": "component.create", "params": {"name": "Arm"}}),
+            json!({"command": "component.create", "params": {"name": "Arm", "grounded": false}}),
             json!({"command": "solid.box", "params": {"corner": [20, 0, 0], "length": 10, "width": 4, "height": 4, "body_name": "ArmBody"}}),
             json!({"command": "component.activate", "params": {"component": 0}}),
             json!({"command": "occurrence.move", "params": {"occurrence": "Arm:1", "translate": [0, 50, 0]}}),
@@ -1665,7 +1665,6 @@ fn a_tangent_plane_on_a_drill_tip() {
 }
 
 #[test]
-#[ignore = "fails until #568 is fixed"]
 fn a_plane_on_a_patterned_counterbore_after_a_thickness_change() {
     let mut c = vec![json!({"command": "parameters.change", "params": {"name": "thick", "expression": "10 mm"}})];
     c.extend(rectangle(json!("XY"), [0., 0.], [80., 30.]));

apps/solidcraft-cli/tests/bracket_example.rs

@@ -0,0 +1,62 @@
+//! The bracket example must cut two through holes, rather than successfully cutting empty
+//! space beside the body. Check the shipped script and rebuild its saved design from scratch.
+
+use std::f64::consts::PI;
+
+use serde_json::Value;
+use solidcraft_engine::geom::Vec3;
+use solidcraft_engine::{Session, io, kernel};
+
+fn assert_two_through_holes(session: &Session, stage: &str) {
+    let errors: Vec<_> = session.model.results.iter().filter_map(|r| r.error.as_ref().map(|e| (&r.name, e))).collect();
+    assert!(errors.is_empty(), "{stage}: every example feature evaluates: {errors:?}");
+
+    let cut = session.doc.features.last().expect("the example ends with the hole cut");
+    let before = session.model.state_before(cut.id);
+    let after = session.model.state();
+    assert_eq!(before.bodies.len(), 1, "{stage}: one bracket before cutting the holes");
+    assert_eq!(after.bodies.len(), 1, "{stage}: the holes leave one bracket");
+    let uncut = &before.body("Bracket").expect("the uncut bracket").body;
+    let bracket = &after.body("Bracket").expect("the finished bracket").body;
+
+    // Measure the actual state before the final cut so the existing edge fillet cancels out.
+    // Both holes have diameter 8 mm and pass through the 6 mm base. Kernel measurements are
+    // tessellated, so the relative tolerance applies to the removed material, not the body.
+    let removed = kernel::measure(uncut).unwrap().volume - kernel::measure(bracket).unwrap().volume;
+    let expected = 2.0 * PI * 4.0_f64.powi(2) * 6.0;
+    assert!((removed - expected).abs() < expected * 1e-3, "{stage}: the two holes remove {removed} mm³, expected {expected} mm³");
+
+    let before_mesh = uncut.tessellate(0.01).unwrap();
+    let after_mesh = bracket.tessellate(0.01).unwrap();
+    let down = Vec3::new(0.0, 0.0, -1.0);
+    for y in [-15.0, -45.0] {
+        let center = Vec3::new(25.0, y, 1.0);
+        assert_eq!(before_mesh.ray_crossings(center, down), 2, "{stage}: hole at y={y} starts over the solid base");
+        // Rays through each opening must miss the entire bracket, including its top and
+        // bottom caps. Points away from the centre guard against a narrow slit or shifted cut.
+        for (dx, dy) in [(0.0, 0.0), (3.0, 0.0), (-3.0, 0.0), (0.0, 3.0), (0.0, -3.0)] {
+            let ray = center + Vec3::new(dx, dy, 0.0);
+            assert_eq!(after_mesh.ray_crossings(ray, down), 0, "{stage}: the hole at y={y} is open through both caps at ({dx}, {dy})");
+        }
+        // Material just outside each radius remains, so neither opening is an edge notch.
+        for (dx, dy) in [(5.0, 0.0), (-5.0, 0.0), (0.0, 5.0), (0.0, -5.0)] {
+            let ray = center + Vec3::new(dx, dy, 0.0);
+            assert_eq!(after_mesh.ray_crossings(ray, down), 2, "{stage}: material remains around the hole at y={y}, offset ({dx}, {dy})");
+        }
+    }
+}
+
+#[test]
+fn bracket_example_cuts_two_through_holes_and_reopens() {
+    let script: Value = serde_json::from_str(include_str!("../../../examples/bracket.json")).unwrap();
+    let mut session = Session::default();
+    session.run_script(&script).unwrap();
+    assert_two_through_holes(&session, "script");
+
+    // No geometry cache is supplied: reopening the container re-evaluates the saved timeline.
+    let saved = io::write_design_container(&session.doc).unwrap();
+    let document = io::read_design(&saved).unwrap();
+    assert_eq!(document.features, session.doc.features, "saving preserves the example's feature parameters");
+    let reopened = Session::new(document);
+    assert_two_through_holes(&reopened, "reopened");
+}

apps/solidcraft-cli/tests/corpus/scripts/components-arm.json

@@ -1,6 +1,6 @@
 {"commands": [
  {"command": "solid.box", "params": {"length": 10, "width": 10, "height": 10, "body_name": "Base"}},
- {"command": "component.create", "params": {"name": "Arm"}},
+ {"command": "component.create", "params": {"name": "Arm", "grounded": false}},
  {"command": "solid.box", "params": {"corner": [20, 0, 0], "length": 10, "width": 4, "height": 4, "body_name": "ArmBody"}},
  {"command": "solid.fillet", "params": {"edges": [[25, 4, 4]], "radius": 1}},
  {"command": "component.activate", "params": {"component": 0}},

apps/solidcraft-cli/tests/design_corpus.rs

@@ -27,7 +27,7 @@ const KNOWN: [(&str, &str, &str); 2] = [
     (
         "m0-revolve-primitives",
         "Body1 bbox",
-        "partial revolves turn toward the sketch normal since ac43365 (as Fusion's do); M0 turned them the other way",
+        "partial revolves turn toward the sketch normal since ac43365 (as most parametric CAD tools do); M0 turned them the other way",
     ),
     ("components-arm", "body_count", "Measure counted only the root component's bodies then; it measures every placed body now"),
 ];

apps/solidcraft-cli/tests/help_output.rs

@@ -0,0 +1,159 @@
+//! An explicit help request prints usage to stdout and succeeds; an unknown command still fails.
+
+use std::process::{Command, Stdio};
+use std::time::{Duration, Instant};
+
+/// Every command the CLI takes, with the name its own usage names: `inspect` is `eval`, and
+/// `licenses` is `licences`.
+const COMMANDS: &[(&str, &str)] = &[
+    ("run", "run"),
+    ("eval", "eval"),
+    ("inspect", "eval"),
+    ("script", "script"),
+    ("bench-open", "bench-open"),
+    ("bench-agent", "bench-agent"),
+    ("snapshot", "snapshot"),
+    ("render", "render"),
+    ("exec", "exec"),
+    ("commands", "commands"),
+    ("recipe", "recipe"),
+    ("oracle", "oracle"),
+    ("fuzz", "fuzz"),
+    ("fuzz-one", "fuzz-one"),
+    ("mcp", "mcp"),
+    ("crashes", "crashes"),
+    ("licences", "licences"),
+    ("licenses", "licences"),
+    ("gpu", "gpu"),
+    ("icon", "icon"),
+    ("bench-edit", "bench-edit"),
+    ("save-stress", "save-stress"),
+];
+
+/// The commands the usage lists: the aliases answer to another command's name.
+const LISTED: &[&str] = &[
+    "run",
+    "eval",
+    "script",
+    "bench-open",
+    "bench-agent",
+    "snapshot",
+    "render",
+    "exec",
+    "commands",
+    "recipe",
+    "oracle",
+    "fuzz",
+    "mcp",
+    "crashes",
+    "licences",
+    "gpu",
+    "icon",
+];
+
+/// The command names a text mentions after `solidcraft-cli `, each one only once.
+fn mentioned(text: &str) -> Vec<&str> {
+    let mut names: Vec<&str> = text.split("solidcraft-cli ").skip(1).filter_map(|rest| rest.split_whitespace().next()).collect();
+    names.sort_unstable();
+    names.dedup();
+    names
+}
+
+/// Runs the binary and waits at most `limit` for it to finish. `None` means it was still
+/// running and was killed: the fuzz run `fuzz --help` used to start goes on for minutes.
+fn run_within(limit: Duration, args: &[&str]) -> Option<(Option<i32>, String, String)> {
+    let mut child = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(args).stdout(Stdio::piped()).stderr(Stdio::piped()).spawn().unwrap();
+    let started = Instant::now();
+    loop {
+        match child.try_wait().unwrap() {
+            Some(status) => {
+                let out = child.wait_with_output().unwrap();
+                return Some((status.code(), String::from_utf8_lossy(&out.stdout).into_owned(), String::from_utf8_lossy(&out.stderr).into_owned()));
+            }
+            None if started.elapsed() >= limit => {
+                let _ = child.kill();
+                let _ = child.wait();
+                return None;
+            }
+            None => std::thread::sleep(Duration::from_millis(25)),
+        }
+    }
+}
+
+#[test]
+fn help_prints_usage_and_succeeds() {
+    for arg in ["--help", "-h", "help"] {
+        let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).arg(arg).output().unwrap();
+        assert!(output.status.success(), "{arg}: {}", String::from_utf8_lossy(&output.stderr));
+        let stdout = String::from_utf8_lossy(&output.stdout);
+        assert!(stdout.starts_with("usage:"), "{arg}: {stdout}");
+        assert!(stdout.contains("solidcraft-cli run"), "{arg}: {stdout}");
+        assert!(output.stderr.is_empty(), "{arg}: {}", String::from_utf8_lossy(&output.stderr));
+    }
+}
+
+#[test]
+fn unknown_command_still_fails_with_usage() {
+    let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).arg("--not-a-command").output().unwrap();
+    assert!(!output.status.success());
+    assert!(output.stdout.is_empty());
+    assert!(String::from_utf8_lossy(&output.stderr).starts_with("error: usage:"));
+}
+
+#[test]
+fn every_command_prints_its_own_usage() {
+    for (cmd, named) in COMMANDS {
+        for flag in ["--help", "-h"] {
+            let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args([*cmd, flag]).output().unwrap();
+            assert!(output.status.success(), "{cmd} {flag}: {}", String::from_utf8_lossy(&output.stderr));
+            let stdout = String::from_utf8_lossy(&output.stdout);
+            assert!(stdout.starts_with("usage:"), "{cmd} {flag}: {stdout}");
+            assert_eq!(mentioned(&stdout), vec![*named], "{cmd} {flag} printed another command's usage: {stdout}");
+            assert!(output.stderr.is_empty(), "{cmd} {flag}: {}", String::from_utf8_lossy(&output.stderr));
+        }
+    }
+}
+
+#[test]
+fn the_top_level_usage_still_lists_every_command() {
+    let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).arg("--help").output().unwrap();
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    for cmd in LISTED {
+        assert!(stdout.contains(&format!("solidcraft-cli {cmd}")), "{cmd}: {stdout}");
+    }
+}
+
+#[test]
+fn fuzz_help_does_not_start_a_fuzz_run() {
+    let Some((code, stdout, stderr)) = run_within(Duration::from_secs(20), &["fuzz", "--help"]) else {
+        panic!("`fuzz --help` kept running: it started a fuzz run instead of printing the usage");
+    };
+    assert_eq!(code, Some(0), "{stderr}");
+    assert!(stdout.starts_with("usage:"), "{stdout}");
+    assert_eq!(mentioned(&stdout), vec!["fuzz"], "{stdout}");
+    assert!(stderr.is_empty(), "{stderr}");
+}
+
+#[test]
+fn fuzz_refuses_an_argument_it_does_not_take() {
+    for arg in ["--not-a-flag", "stray"] {
+        let Some((code, _stdout, stderr)) = run_within(Duration::from_secs(20), &["fuzz", arg]) else {
+            panic!("`fuzz {arg}` kept running: it started a fuzz run instead of refusing the argument");
+        };
+        assert_ne!(code, Some(0), "`fuzz {arg}` succeeded");
+        assert!(stderr.contains(arg), "`fuzz {arg}`: {stderr}");
+    }
+}
+
+#[test]
+fn render_help_keeps_the_registered_gpu_request_controls() {
+    for args in [vec!["--help"], vec!["render", "--help"]] {
+        let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(&args).output().unwrap();
+        assert!(output.status.success(), "{args:?}: {}", String::from_utf8_lossy(&output.stderr));
+        assert!(output.stderr.is_empty());
+        let stdout = String::from_utf8_lossy(&output.stdout);
+        for flag in ["--progressive", "--samples", "--max-depth", "--seed", "--exposure", "--lighting", "--environment", "--tone-map"] {
+            assert!(stdout.contains(flag), "{args:?} lost {flag}: {stdout}");
+        }
+    }
+}

apps/solidcraft-cli/tests/mcp_connect.rs

@@ -89,3 +89,177 @@ fn mcp_connect_without_a_port_is_refused_at_start() {
         assert!(stderr.contains("HOST:PORT"), "{addr}: {stderr}");
     }
 }
+
+/// `mcp` with no arguments finds the running app through the discovery file and uses that
+/// launch's token; with no app behind the file it stays a headless session.
+#[test]
+fn mcp_without_arguments_finds_the_running_app() {
+    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+    let port = listener.local_addr().unwrap().port();
+    let control_dir = std::env::temp_dir().join(format!("solidcraft-mcp-discover-{}-{port}", std::process::id()));
+    std::fs::create_dir_all(&control_dir).unwrap();
+    let token = "fedcba9876543210".repeat(4);
+    std::fs::write(control_dir.join(format!("{port}.token")), &token).unwrap();
+    std::fs::write(control_dir.join("current.port"), format!("{port}\n")).unwrap();
+    let app = std::thread::spawn(move || {
+        // The discovery probe connects and leaves without a request; the tool call follows.
+        let (stream, line) = loop {
+            let (stream, _) = listener.accept().unwrap();
+            let mut line = String::new();
+            BufReader::new(stream.try_clone().unwrap()).read_line(&mut line).unwrap();
+            if !line.is_empty() {
+                break (stream, line);
+            }
+        };
+        let req: Value = serde_json::from_str(&line).unwrap();
+        let ok = req["token"] == json!(token);
+        let reply = json!({"id": req["id"], "ok": ok, "result": {"bodies": [], "method": req["method"]}, "error": "unauthorized"});
+        writeln!(&stream, "{reply}").unwrap();
+    });
+    let mut child = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+        .args(["mcp", "--allow-any-path"])
+        .env("SOLIDCRAFT_CONTROL_DIR", &control_dir)
+        .env_remove("SOLIDCRAFT_CONTROL_TOKEN")
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .spawn()
+        .unwrap();
+    let mut stdin = child.stdin.take().unwrap();
+    let mut stdout = BufReader::new(child.stdout.take().unwrap());
+    writeln!(stdin, "{}", json!({"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "measure", "arguments": {}}})).unwrap();
+    let mut line = String::new();
+    stdout.read_line(&mut line).unwrap();
+    let r: Value = serde_json::from_str(&line).unwrap_or_else(|e| panic!("{e}: {line:?}"));
+    assert_ne!(r["result"]["isError"], true, "{r}");
+    assert!(r["result"]["content"][0]["text"].as_str().unwrap_or_default().contains("engine.execute"), "{r}");
+    app.join().unwrap();
+    drop(stdin);
+    assert!(child.wait().unwrap().success());
+
+    // The file names a port nothing listens on (the app crashed): a headless session instead.
+    let closed = TcpListener::bind("127.0.0.1:0").unwrap();
+    let dead = closed.local_addr().unwrap().port();
+    drop(closed);
+    std::fs::write(control_dir.join("current.port"), format!("{dead}\n")).unwrap();
+    let out = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+        .args(["mcp", "--allow-any-path"])
+        .env("SOLIDCRAFT_CONTROL_DIR", &control_dir)
+        .stdin(Stdio::null())
+        .output()
+        .unwrap();
+    assert!(!String::from_utf8_lossy(&out.stderr).contains("bridged to the running app"), "{}", String::from_utf8_lossy(&out.stderr));
+    std::fs::remove_dir_all(&control_dir).ok();
+}
+
+/// `mcp setup` against a temporary home: the client folders it finds are the only ones it writes.
+mod setup {
+    use serde_json::{Value, json};
+    use std::path::{Path, PathBuf};
+    use std::process::Command;
+
+    fn home(name: &str) -> PathBuf {
+        let h = std::env::temp_dir().join(format!("solidcraft-mcp-setup-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&h);
+        std::fs::create_dir_all(&h).unwrap();
+        h
+    }
+
+    fn run(home: &Path, args: &[&str]) -> std::process::Output {
+        Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+            .args(["mcp", "setup"])
+            .args(args)
+            .env_clear()
+            .env("HOME", home)
+            .env("USERPROFILE", home)
+            .env("APPDATA", home.join("AppData/Roaming"))
+            .env("LOCALAPPDATA", home.join("AppData/Local"))
+            .env("XDG_CONFIG_HOME", home.join(".config"))
+            .env("PATH", "")
+            .output()
+            .unwrap()
+    }
+
+    fn json_of(p: &Path) -> Value {
+        serde_json::from_str(&std::fs::read_to_string(p).unwrap()).unwrap()
+    }
+
+    fn exe() -> String {
+        let p = Path::new(env!("CARGO_BIN_EXE_solidcraft-cli")).canonicalize().unwrap();
+        p.to_string_lossy().trim_start_matches(r"\\?\").to_owned()
+    }
+
+    #[test]
+    fn merges_into_opencode_and_cursor_keeping_other_servers() {
+        let h = home("merge");
+        let oc = h.join(".config/opencode");
+        std::fs::create_dir_all(&oc).unwrap();
+        let old = json!({"$schema": "https://opencode.ai/config.json", "theme": "x", "mcp": {"other": {"type": "local", "command": ["o"]}}});
+        std::fs::write(oc.join("opencode.json"), old.to_string()).unwrap();
+        std::fs::create_dir_all(h.join(".cursor")).unwrap();
+        std::fs::write(h.join(".cursor/mcp.json"), r#"{"mcpServers": {"other": {"command": "o"}}}"#).unwrap();
+
+        let out = run(&h, &["--live"]);
+        assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
+        let v = json_of(&oc.join("opencode.json"));
+        assert_eq!(v["theme"], "x");
+        assert_eq!(v["mcp"]["other"], old["mcp"]["other"]);
+        assert_eq!(v["mcp"]["solidcraft"], json!({"type": "local", "command": [exe(), "mcp"], "enabled": true}));
+        assert_eq!(v["mcp"]["solidcraft-live"]["command"], json!([exe(), "mcp", "--connect", "127.0.0.1:7878"]));
+        assert_eq!(json_of(&oc.join("opencode.json.bak")), old);
+        let c = json_of(&h.join(".cursor/mcp.json"));
+        assert_eq!(c["mcpServers"]["other"], json!({"command": "o"}));
+        assert_eq!(c["mcpServers"]["solidcraft"], json!({"command": exe(), "args": ["mcp"]}));
+
+        // Codex (TOML) and Claude Code (a big file the CLI owns) are edited in place too.
+        std::fs::create_dir_all(h.join(".codex")).unwrap();
+        std::fs::write(h.join(".codex/config.toml"), "# mine\nmodel = \"x\"\n").unwrap();
+        let cc = "{\n  \"numStartups\": 3,\n  \"projects\": {}\n}\n";
+        std::fs::write(h.join(".claude.json"), cc).unwrap();
+        assert!(run(&h, &[]).status.success());
+        let toml = std::fs::read_to_string(h.join(".codex/config.toml")).unwrap();
+        assert!(toml.starts_with("# mine\nmodel = \"x\"\n") && toml.contains("[mcp_servers.solidcraft]"), "{toml}");
+        let c = json_of(&h.join(".claude.json"));
+        assert_eq!(c["numStartups"], 3);
+        assert_eq!(c["mcpServers"]["solidcraft"], json!({"type": "stdio", "command": exe(), "args": ["mcp"]}));
+        assert_eq!(std::fs::read_to_string(h.join(".claude.json.bak")).unwrap(), cc);
+
+        // Running again updates the same entries and leaves one of each.
+        assert!(run(&h, &[]).status.success());
+        assert_eq!(json_of(&h.join(".cursor/mcp.json"))["mcpServers"].as_object().unwrap().len(), 3);
+    }
+
+    #[test]
+    fn dry_run_writes_nothing_and_missing_clients_are_skipped() {
+        let h = home("dry");
+        std::fs::create_dir_all(h.join(".cursor")).unwrap();
+        let out = run(&h, &["--dry-run"]);
+        assert!(out.status.success());
+        let text = String::from_utf8_lossy(&out.stdout);
+        assert!(text.contains("would write") && text.contains("solidcraft"), "{text}");
+        assert!(!h.join(".cursor/mcp.json").exists());
+        assert!(!h.join(".config/opencode").exists(), "OpenCode was not installed, so nothing is created for it");
+        let out = run(&h, &["--client", "claude-desktop"]);
+        assert!(String::from_utf8_lossy(&out.stdout).contains("not found"));
+    }
+
+    #[test]
+    fn a_file_that_is_not_json_is_left_alone() {
+        let h = home("bad");
+        std::fs::create_dir_all(h.join(".cursor")).unwrap();
+        std::fs::write(h.join(".cursor/mcp.json"), "{ // comment").unwrap();
+        let out = run(&h, &[]);
+        assert!(!out.status.success());
+        assert_eq!(std::fs::read_to_string(h.join(".cursor/mcp.json")).unwrap(), "{ // comment");
+    }
+
+    #[test]
+    fn claude_desktop_msix_folder_is_found() {
+        let h = home("msix");
+        let pkg = h.join("AppData/Local/Packages/Claude_abc/LocalCache/Roaming/Claude");
+        std::fs::create_dir_all(&pkg).unwrap();
+        // The MSIX folder is only read through LOCALAPPDATA, set for every platform here.
+        assert!(run(&h, &["--client", "claude-desktop"]).status.success());
+        assert!(json_of(&pkg.join("claude_desktop_config.json"))["mcpServers"]["solidcraft"].is_object());
+    }
+}

apps/solidcraft-cli/tests/mcp_param_check.rs

@@ -0,0 +1,50 @@
+//! `mcp --in script --param-check <level>`: the level applies to the script the session starts
+//! from too, so a misspelled key in it is refused (strict) or reported on stderr (warn) instead of
+//! silently ignored.
+
+use std::process::{Command, Stdio};
+
+#[test]
+fn param_check_applies_to_the_starting_script() {
+    let dir = std::env::temp_dir().join(format!("solidcraft-mcp-param-check-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let script = dir.join("typo.json");
+    let box_ = r#"{"command": "solid.box", "params": {"length": 5, "width": 5, "height": 5, "operaton": "cut"}}"#;
+    std::fs::write(&script, format!(r#"{{"commands": [{box_}]}}"#)).unwrap();
+    let run = |level: &str| {
+        Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+            .args(["mcp", "--in", script.to_str().unwrap(), "--param-check", level])
+            .stdin(Stdio::null())
+            .output()
+            .unwrap()
+    };
+    let strict = run("strict");
+    let stderr = String::from_utf8_lossy(&strict.stderr);
+    assert!(!strict.status.success(), "{stderr}");
+    assert!(stderr.contains("unknown key `operaton`; did you mean `operation`?"), "{stderr}");
+    // Warn: the script runs, and its warnings go to stderr.
+    let warn = run("warn");
+    let stderr = String::from_utf8_lossy(&warn.stderr);
+    assert!(warn.status.success(), "{stderr}");
+    assert!(stderr.contains("step 1: unknown key `operaton`; did you mean `operation`?"), "{stderr}");
+    // A warned step's warning is printed even when a later step fails.
+    let failing = dir.join("typo_then_failure.json");
+    std::fs::write(&failing, format!(r#"{{"commands": [{box_}, {{"command": "no.such_command"}}]}}"#)).unwrap();
+    let out = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+        .args(["mcp", "--in", failing.to_str().unwrap(), "--param-check", "warn"])
+        .stdin(Stdio::null())
+        .output()
+        .unwrap();
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    assert!(!out.status.success(), "{stderr}");
+    assert!(stderr.contains("step 1: unknown key `operaton`") && stderr.contains("step 2"), "{stderr}");
+    // Off: the script runs as before, and the server ends with its input.
+    let off = run("off");
+    assert!(off.status.success(), "{}", String::from_utf8_lossy(&off.stderr));
+    assert!(!String::from_utf8_lossy(&off.stderr).contains("operaton"));
+    // A bare flag is an error, not off.
+    let bare = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(["mcp", "--param-check"]).stdin(Stdio::null()).output().unwrap();
+    assert!(!bare.status.success());
+    assert!(String::from_utf8_lossy(&bare.stderr).contains("--param-check wants off, warn or strict"));
+    std::fs::remove_dir_all(&dir).ok();
+}

apps/solidcraft-cli/tests/mcp_render_host.rs

@@ -0,0 +1,9 @@
+//! Explicit native GPU registration must not change bridged MCP ownership.
+use std::process::Command;
+#[test]
+fn connected_application_rejects_headless_gpu_installation_before_connecting() {
+    let result = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(["mcp", "--render-gpu", "--connect", "127.0.0.1:1"]).output().unwrap();
+    assert!(!result.status.success());
+    let message = String::from_utf8_lossy(&result.stderr);
+    assert!(message.contains("connected application owns its own device"), "{message}");
+}

apps/solidcraft-cli/tests/model_cache.rs

@@ -0,0 +1,290 @@
+//! A design opened from the model its file keeps is the design evaluated again: the same
+//! results, the same bodies (to the bit), the same face names and volumes after every feature,
+//! and the same after an edit made to both.
+
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+use serde_json::{Value, json};
+use solidcraft_engine::Session;
+use solidcraft_engine::doc::{ModelBody, ModelState, SavedModel};
+
+fn corpus() -> Vec<PathBuf> {
+    let dir = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/corpus");
+    let mut v: Vec<PathBuf> =
+        std::fs::read_dir(&dir).unwrap().flatten().map(|e| e.path()).filter(|p| p.extension().is_some_and(|x| x == "solidcraft")).collect();
+    v.sort();
+    v
+}
+
+fn temp(name: &str) -> PathBuf {
+    std::env::temp_dir().join(format!("solidcraft-model-cache-{}-{name}.solidcraft", std::process::id()))
+}
+
+fn open(path: &Path) -> Session {
+    let mut s = Session::default();
+    s.execute("doc.open", &json!({"path": path.to_string_lossy()})).unwrap_or_else(|e| panic!("{}: {e}", path.display()));
+    s
+}
+
+fn body(name: &str, b: &ModelBody) -> Value {
+    let measured = solidcraft_engine::kernel::measure(&b.body).ok();
+    json!({
+        "name": b.name, "feature": b.feature, "component": b.component, "source": b.source_name, "transferred": b.transferred,
+        "brep": solidcraft_engine::kernel::encode_native_body(&b.body).map(|bytes| format!("{:x}", sha(&bytes))).unwrap_or_else(|e| format!("{name}: {e}")),
+        "faces": *solidcraft_engine::doc::naming::face_names(b),
+        "volume": measured.as_ref().map(|m| m.volume.to_bits()), "area": measured.as_ref().map(|m| m.area.to_bits()),
+        "look": b.imported.as_ref().map(|l| format!("{l:?}")),
+    })
+}
+
+fn sha(bytes: &[u8]) -> u128 {
+    use std::hash::{Hash, Hasher};
+    let mut h = std::collections::hash_map::DefaultHasher::new();
+    bytes.hash(&mut h);
+    let a = h.finish();
+    bytes.len().hash(&mut h);
+    (u128::from(a) << 64) | u128::from(h.finish())
+}
+
+fn state(name: &str, st: &Arc<ModelState>) -> Value {
+    json!({
+        "bodies": st.bodies.iter().map(|b| body(name, b)).collect::<Vec<_>>(),
+        "sketches": st.sketches.iter().map(|s| json!([s.feature, s.name, s.plane, s.sketch, s.report, s.profiles.len()])).collect::<Vec<_>>(),
+        "counter": st.body_counter, "sheets": st.sheets, "threads": st.threads, "construct": format!("{:?}", st.construct),
+    })
+}
+
+/// Everything a model holds that the rest of the app reads.
+fn model(name: &str, s: &Session) -> Value {
+    let results: Vec<Value> = s
+        .model
+        .results
+        .iter()
+        .map(|r| json!({"id": r.id, "name": r.name, "error": r.error, "warning": r.warning, "skipped": r.skipped, "state": state(name, &r.state)}))
+        .collect();
+    json!({"results": results, "world": state(name, &s.world_state())})
+}
+
+/// The same edit on both: a parameter's value when the design has one, else a new body.
+fn edit(s: &mut Session) {
+    let param = s.doc.params.first().map(|p| (p.name.clone(), p.expr.clone()));
+    match param {
+        Some((name, expr)) => {
+            s.execute("parameters.change", &json!({"name": name, "expression": format!("({expr}) * 1.05")})).unwrap();
+        }
+        None => {
+            s.execute("solid.box", &json!({"length": 7, "width": 8, "height": 9, "operation": "new"})).unwrap();
+        }
+    }
+}
+
+fn check(name: &str, mut built: Session) {
+    let path = temp(name);
+    built.execute("file.save_as", &json!({"path": path.to_string_lossy()})).unwrap();
+    let bytes = std::fs::read(&path).unwrap();
+    assert!(solidcraft_engine::io::read_design_geometry(&bytes).is_some(), "{name}: the save keeps the model");
+    let mut cached = open(&path);
+    assert_eq!(cached.model.last_recomputed, 0, "{name}: opened without evaluating");
+    let mut rebuilt = Session::new(solidcraft_engine::io::read_design(&bytes).unwrap());
+    assert!(rebuilt.model.last_recomputed > 0);
+    assert_eq!(model(name, &cached), model(name, &rebuilt), "{name}: opened from the file's model");
+    edit(&mut cached);
+    edit(&mut rebuilt);
+    assert_eq!(model(name, &cached), model(name, &rebuilt), "{name}: after the same edit");
+    cached.execute("edit.undo", &json!({})).unwrap();
+    rebuilt.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(model(name, &cached), model(name, &rebuilt), "{name}: after undoing it");
+    let _ = std::fs::remove_file(&path);
+    let _ = std::fs::remove_file(format!("{}.bak", path.display()));
+}
+
+#[test]
+fn corpus_designs_open_from_their_model_as_evaluated() {
+    for p in corpus() {
+        let name = p.file_stem().unwrap_or_default().to_string_lossy().to_string();
+        let s = open(&p);
+        // Names saved before format 14 are found again through names worked out from geometry on
+        // demand, which a saved model does not keep.
+        let legacy = s.doc.to_json().contains(&format!("\"{}", solidcraft_engine::doc::naming::LEGACY_MARK));
+        if s.model.results.iter().any(|r| r.error.is_some()) || legacy {
+            // Not kept: a model with errors, or names saved before format 14.
+            let path = temp(&name);
+            let mut s = s;
+            s.execute("file.save_as", &json!({"path": path.to_string_lossy()})).unwrap();
+            assert!(solidcraft_engine::io::read_design_geometry(&std::fs::read(&path).unwrap()).is_none(), "{name}");
+            let _ = std::fs::remove_file(&path);
+            let _ = std::fs::remove_file(format!("{}.bak", path.display()));
+            continue;
+        }
+        check(&name, s);
+    }
+}
+
+#[test]
+fn sample_designs_open_from_their_model_as_evaluated() {
+    for sample in solidcraft_engine::sample::samples() {
+        let mut s = Session::default();
+        for c in (sample.script)()["commands"].as_array().unwrap() {
+            s.execute(c["command"].as_str().unwrap(), &c["params"]).unwrap_or_else(|e| panic!("{}: {e}", sample.name));
+        }
+        check(sample.name, s);
+    }
+}
+
+#[test]
+fn imported_assemblies_open_from_their_model_as_evaluated() {
+    // A STEP assembly of the hinge sample: parts placed several times.
+    let mut source = Session::default();
+    let hinge = solidcraft_engine::sample::samples().into_iter().find(|s| s.name == "Hinge Assembly").unwrap();
+    for c in (hinge.script)()["commands"].as_array().unwrap() {
+        source.execute(c["command"].as_str().unwrap(), &c["params"]).unwrap();
+    }
+    let step = std::env::temp_dir().join(format!("solidcraft-model-cache-{}-hinge.step", std::process::id()));
+    source.execute("file.export", &json!({"path": step.to_string_lossy()})).unwrap();
+    let mut s = Session::default();
+    s.execute("file.insert_step", &json!({"path": step.to_string_lossy()})).unwrap();
+    s.execute("file.insert_step", &json!({"path": step.to_string_lossy(), "matrix": [1, 0, 0, 200, 0, 1, 0, 0, 0, 0, 1, 0]})).unwrap();
+    let _ = std::fs::remove_file(&step);
+    check("imported hinge", s);
+}
+
+/// `built` saved with `saved`, a model of it that keeps only some states (as a file without room
+/// for all of them does, #3220), opens as the design evaluated again: evaluating just the
+/// features whose state the file left out, then after suppressing a feature at, before or after
+/// each state it kept, after undoing that, and with the marker moved there and back.
+fn check_thinned(name: &str, built: &Session, saved: &SavedModel) {
+    let design = built.design();
+    let bytes =
+        solidcraft_engine::io::write_design_container_with_cache(&design, solidcraft_engine::io::DesignCompression::Fast, None, Some(saved)).unwrap();
+    assert!(solidcraft_engine::io::read_design_geometry(&bytes).is_some(), "{name}: the file keeps the final state");
+    let path = temp(&name.replace(' ', "-"));
+    std::fs::write(&path, &bytes).unwrap();
+    let mut cached = open(&path);
+    let mut rebuilt = Session::new(solidcraft_engine::io::read_design(&bytes).unwrap());
+    let features = saved.records["features"].as_array().unwrap();
+    let unkept = features.iter().filter(|f| f["skipped"] == false && f.get("state").is_none()).count();
+    assert!(unkept > 0, "{name}: some states left out");
+    assert_eq!(cached.model.recomputed, unkept, "{name}: evaluated just the features whose state the file left out");
+    assert_eq!(model(name, &cached), model(name, &rebuilt), "{name}: opened from the file's model");
+    let n = cached.doc.features.len();
+    let mut at: Vec<usize> = features
+        .iter()
+        .enumerate()
+        .filter(|(_, f)| f["skipped"] == false && f.get("state").is_some())
+        .flat_map(|(k, _)| [k.saturating_sub(1), k, k + 1])
+        .filter(|i| *i < n)
+        .collect();
+    at.dedup();
+    for i in at {
+        let edit = json!({"feature": cached.doc.features[i].id, "suppressed": true});
+        let (a, b) = (cached.execute("timeline.suppress", &edit), rebuilt.execute("timeline.suppress", &edit));
+        assert_eq!(a.is_ok(), b.is_ok(), "{name}: suppressing feature {i}");
+        assert_eq!(model(name, &cached), model(name, &rebuilt), "{name}: feature {i} suppressed");
+        if a.is_ok() {
+            cached.execute("edit.undo", &json!({})).unwrap();
+            rebuilt.execute("edit.undo", &json!({})).unwrap();
+            assert_eq!(model(name, &cached), model(name, &rebuilt), "{name}: suppressing feature {i} undone");
+        }
+        for marker in [json!({"position": i}), json!({})] {
+            cached.execute("timeline.rollback", &marker).unwrap();
+            rebuilt.execute("timeline.rollback", &marker).unwrap();
+            assert_eq!(model(name, &cached), model(name, &rebuilt), "{name}: the marker at {marker}, from feature {i}");
+        }
+    }
+    let _ = std::fs::remove_file(&path);
+}
+
+/// A model too big for its file keeps the final state, then the slowest features' states as fit
+/// (#3220). Both the smallest such model (the final state, and states that add no body to it)
+/// and one that keeps more open as the design evaluated again. The placed components' design has
+/// a cut whose fingerprint reads where the bodies before it lie, which a state left out does not
+/// say until it is evaluated.
+#[test]
+fn thinned_models_open_as_evaluated() {
+    let corpus = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/corpus/components-arm.solidcraft");
+    for sample in ["Sample Plate", "Plastic Enclosure", "components-arm"] {
+        let built = match solidcraft_engine::sample::samples().into_iter().find(|s| s.name == sample) {
+            Some(s) => {
+                let mut built = Session::default();
+                for c in (s.script)()["commands"].as_array().unwrap() {
+                    built.execute(c["command"].as_str().unwrap(), &c["params"]).unwrap();
+                }
+                built
+            }
+            None => open(&corpus),
+        };
+        let saved = built.model.saved(&built.design()).unwrap();
+        // Every body a megabyte (the records fit in the room left over): each budget keeps one more
+        // body's worth of states.
+        let body = 1 << 20;
+        let pieces: Vec<Vec<(usize, usize)>> = (0..saved.bodies.len()).map(|i| vec![(i, body)]).collect();
+        let thinned: Vec<SavedModel> =
+            (0..=saved.bodies.len()).filter_map(|n| saved.thinned(&pieces, n * body + body - 1).map(|(m, _, _)| m)).collect();
+        let kept = |m: &SavedModel| m.records["features"].as_array().unwrap().iter().filter(|f| f.get("state").is_some()).count();
+        let smallest = thinned.first().unwrap();
+        assert!(smallest.records["states"].as_array().unwrap().len() < saved.records["states"].as_array().unwrap().len(), "{sample}");
+        let more = thinned.iter().find(|m| kept(m) > kept(smallest) && kept(m) < built.doc.features.len()).unwrap();
+        check_thinned(&format!("{sample} smallest"), &built, smallest);
+        check_thinned(&format!("{sample} thinned"), &built, more);
+    }
+}
+
+/// Opened from its model, a design evaluates only from the first feature an edit changes: the
+/// saved states before it are kept as they were read (the same states, not evaluated again).
+#[test]
+fn an_edit_after_opening_evaluates_from_the_feature_it_changes() {
+    let plate = solidcraft_engine::sample::samples().into_iter().find(|s| s.name == "Sample Plate").unwrap();
+    let mut built = Session::default();
+    for c in (plate.script)()["commands"].as_array().unwrap() {
+        built.execute(c["command"].as_str().unwrap(), &c["params"]).unwrap();
+    }
+    let path = temp("incremental");
+    built.execute("file.save_as", &json!({"path": path.to_string_lossy()})).unwrap();
+    let n = built.doc.features.len();
+    assert!(n >= 4);
+    let mut s = open(&path);
+    assert_eq!(s.model.last_recomputed, 0);
+    let read: Vec<Arc<ModelState>> = s.model.results.iter().map(|r| r.state.clone()).collect();
+    // How many of the first features still have the states read from the file.
+    let kept = |s: &Session| s.model.results.iter().zip(&read).take_while(|(r, st)| Arc::ptr_eq(&r.state, st)).count();
+    // The marker moved back and forth: the features before it are as read.
+    s.execute("timeline.rollback", &json!({"position": n - 2})).unwrap();
+    assert_eq!(kept(&s), n - 2, "rolled back");
+    s.execute("timeline.rollback", &json!({})).unwrap();
+    assert_eq!(kept(&s), n, "rolled forward: the features after the marker take their saved results again");
+    // Suppressing the second-to-last feature keeps every state before it.
+    let k = s.doc.features[n - 2].id;
+    s.execute("timeline.suppress", &json!({"feature": k, "suppressed": true})).unwrap();
+    assert_eq!(kept(&s), n - 2, "evaluated from the suppressed feature on");
+    s.execute("edit.undo", &json!({})).unwrap();
+    // A new feature at the end starts from the final state read from the file.
+    let mut s = open(&path);
+    let read: Vec<Arc<ModelState>> = s.model.results.iter().map(|r| r.state.clone()).collect();
+    s.execute("solid.box", &json!({"length": 3, "width": 3, "height": 3, "operation": "new"})).unwrap();
+    assert_eq!(s.model.results.len(), n + 1);
+    assert!(s.model.results.iter().zip(&read).all(|(r, st)| Arc::ptr_eq(&r.state, st)), "only the new feature evaluated");
+    let _ = std::fs::remove_file(&path);
+    let _ = std::fs::remove_file(format!("{}.bak", path.display()));
+}
+
+/// An edit made after opening and undone finds the saved results again: undo evaluates nothing.
+#[test]
+fn undoing_an_edit_after_opening_reuses_the_saved_results() {
+    let plate = solidcraft_engine::sample::samples().into_iter().find(|s| s.name == "Sample Plate").unwrap();
+    let mut built = Session::default();
+    for c in (plate.script)()["commands"].as_array().unwrap() {
+        built.execute(c["command"].as_str().unwrap(), &c["params"]).unwrap();
+    }
+    let path = temp("undo");
+    built.execute("file.save_as", &json!({"path": path.to_string_lossy()})).unwrap();
+    let mut s = open(&path);
+    let read: Vec<Arc<ModelState>> = s.model.results.iter().map(|r| r.state.clone()).collect();
+    let first = s.doc.features[1].id;
+    s.execute("timeline.suppress", &json!({"feature": first, "suppressed": true})).unwrap();
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(s.model.last_recomputed, 0, "taken from the saved results");
+    assert!(s.model.results.iter().zip(&read).all(|(r, st)| Arc::ptr_eq(&r.state, st)), "the very states read from the file");
+    let _ = std::fs::remove_file(&path);
+    let _ = std::fs::remove_file(format!("{}.bak", path.display()));
+}

apps/solidcraft-cli/tests/oracle_cases.rs

@@ -0,0 +1,66 @@
+//! The reference tests (tests/oracle, docs/oracle.md) as a `cargo test`, so tools that drive
+//! `cargo test` (cargo-mutants) can use them: every case with expected values and no
+//! `known_failure` mark must pass, as `cargo xtask oracle` requires.
+
+use std::path::Path;
+use std::process::Command;
+
+use serde_json::Value;
+
+#[test]
+#[ignore = "run by cargo-mutants (.cargo/mutants.toml); CI replays the oracle through cargo xtask oracle"]
+fn oracle_suite() {
+    let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
+    let dir = root.join("tests/oracle");
+    let mut cases: Vec<String> = std::fs::read_dir(&dir)
+        .unwrap()
+        .flatten()
+        .map(|e| e.path())
+        .filter(|p| p.join("recipe.json").is_file())
+        .map(|p| format!("tests/oracle/{}", p.file_name().unwrap().to_string_lossy()))
+        .collect();
+    cases.sort();
+    assert!(cases.len() >= 50, "oracle cases in {}", dir.display());
+    // One process per core, cases dealt round-robin so the slow ones spread out.
+    let n = std::thread::available_parallelism().map_or(4, |n| n.get()).min(cases.len());
+    let children: Vec<_> = (0..n)
+        .map(|i| {
+            let chunk: Vec<&String> = cases.iter().skip(i).step_by(n).collect();
+            Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+                .current_dir(&root)
+                .arg("oracle")
+                .arg("--json")
+                .args(chunk)
+                .stdout(std::process::Stdio::piped())
+                .stderr(std::process::Stdio::piped())
+                .spawn()
+                .unwrap()
+        })
+        .collect();
+    let mut results: Vec<Value> = Vec::new();
+    for child in children {
+        let out = child.wait_with_output().unwrap();
+        let part: Vec<Value> =
+            serde_json::from_slice(&out.stdout).unwrap_or_else(|e| panic!("oracle JSON: {e}\n{}", String::from_utf8_lossy(&out.stderr)));
+        results.extend(part);
+    }
+    assert_eq!(results.len(), cases.len());
+    let mut failed = Vec::new();
+    for r in &results {
+        let case = r["case"].as_str().unwrap_or("");
+        let want: Value =
+            std::fs::read_to_string(dir.join(case).join("expected.json")).ok().and_then(|t| serde_json::from_str(&t).ok()).unwrap_or_default();
+        if want.is_null() || want["known_failure"].is_string() || r["pass"].as_bool().unwrap_or(false) {
+            continue;
+        }
+        let checks: Vec<String> = r["checks"]
+            .as_array()
+            .into_iter()
+            .flatten()
+            .filter(|c| !c["ok"].as_bool().unwrap_or(false))
+            .map(|c| format!("{} got {} want {}", c["check"].as_str().unwrap_or(""), c["got"], c["want"]))
+            .collect();
+        failed.push(format!("{case}: {} {}", r["error"].as_str().unwrap_or(""), checks.join("; ")));
+    }
+    assert!(failed.is_empty(), "oracle cases failed:\n{}", failed.join("\n"));
+}

apps/solidcraft-cli/tests/run_results.rs

@@ -59,6 +59,84 @@ fn cli_loads_both_design_encodings_by_contents() {
     }
 }
 
+/// #1369: a pending concept that did not land in the numbered release must not be silently
+/// dropped on open/resave, in either encoding or before replacing an existing destination.
+#[test]
+fn unknown_pending_concepts_preserve_the_open_design_and_output_files() {
+    use solidcraft_engine::{Session, doc, io};
+
+    let dir = Scratch::new();
+    for version in [33, doc::format::FORMAT] {
+        let mut experimental = doc::Document::new("Experimental");
+        experimental.format = doc::format::format_string(version);
+        experimental.format_pending.push("experimental-card".into());
+        for (extension, bytes) in [("json", io::write_design(&experimental)), ("solidcraft", io::write_design_container(&experimental).unwrap())] {
+            let source = dir.0.join(format!("experimental-{version}.{extension}"));
+            std::fs::write(&source, &bytes).unwrap();
+            let mut session = Session::default();
+            session.execute("solid.box", &json!({"length": 2, "width": 3, "height": 4})).unwrap();
+            let original = session.doc.clone();
+            let original_path = session.path.clone();
+            let undo = session.undo.len();
+            let dirty = session.is_dirty();
+            let err = session.execute("doc.open", &json!({"path": source})).unwrap_err().to_string();
+            assert!(err.contains("experimental-card") && err.contains("update SolidCraft"), "{err}");
+            assert_eq!(session.doc, original);
+            assert_eq!(session.path, original_path);
+            assert_eq!(session.undo.len(), undo);
+            assert_eq!(session.is_dirty(), dirty);
+
+            for existing in [false, true] {
+                let destination = dir.0.join(format!("output-{version}-{extension}-{existing}.{extension}"));
+                let backup = io::backup_path(&destination);
+                if existing {
+                    std::fs::write(&destination, b"existing design").unwrap();
+                    std::fs::write(&backup, b"existing backup").unwrap();
+                }
+                let output = cli().args(["run", "--in"]).arg(&source).arg("--save").arg(&destination).output().unwrap();
+                assert_eq!(output.status.code(), Some(1));
+                let error = String::from_utf8_lossy(&output.stderr);
+                assert!(error.contains("experimental-card") && error.contains("update SolidCraft"), "{error}");
+                if existing {
+                    assert_eq!(std::fs::read(&destination).unwrap(), b"existing design");
+                    assert_eq!(std::fs::read(&backup).unwrap(), b"existing backup");
+                } else {
+                    assert!(!destination.exists() && !backup.exists());
+                }
+                assert_eq!(std::fs::read(&source).unwrap(), bytes);
+            }
+        }
+    }
+}
+
+#[test]
+fn known_pending_concepts_and_released_files_round_trip_with_inert_metadata() {
+    use solidcraft_engine::{doc, io};
+
+    let dir = Scratch::new();
+    let current = doc::Document::new("Supported");
+    let mut released = current.clone();
+    released.format = doc::format::format_string(33);
+    released.format_pending.clear();
+    let mut experimental = released.clone();
+    experimental.format_pending.push("reserved-body-names".into());
+    for (index, mut document) in [current, released, experimental].into_iter().enumerate() {
+        document.metadata.0.insert("com.example.tool".into(), json!({"format_pending": ["experimental-card"], "physical_card": {"density": 700}}));
+        for (extension, bytes) in [("json", io::write_design(&document)), ("solidcraft", io::write_design_container(&document).unwrap())] {
+            let source = dir.0.join(format!("supported-{index}.{extension}"));
+            let destination = dir.0.join(format!("resaved-{index}.{extension}"));
+            std::fs::write(&source, &bytes).unwrap();
+            let output = cli().args(["run", "--in"]).arg(&source).arg("--save").arg(&destination).output().unwrap();
+            assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
+            let reopened = io::read_design(&std::fs::read(&destination).unwrap()).unwrap();
+            assert_eq!(reopened.metadata, document.metadata);
+            assert_eq!(reopened.name, document.name);
+            assert_eq!(reopened.features, document.features);
+            assert_eq!(std::fs::read(&source).unwrap(), bytes);
+        }
+    }
+}
+
 #[test]
 fn results_still_save_and_export_the_script_once() {
     let dir = Scratch::new();
@@ -209,3 +287,175 @@ fn timings_and_profile_report_each_command() {
     assert!(!output.status.success());
     assert!(String::from_utf8_lossy(&output.stderr).contains("--timings needs a script"));
 }
+
+fn render_setup_script(dir: &Scratch, job: Value) -> PathBuf {
+    let path = dir.0.join("render.json");
+    std::fs::write(
+        &path,
+        json!({"commands":[
+            {"command":"solid.box","params":{"length":10,"width":10,"height":10}},
+            {"command":"render.settings.set","params":{"name":"Portable setup","set":{"width":16,"height":16,"job":job}}}
+        ]})
+        .to_string(),
+    )
+    .unwrap();
+    path
+}
+
+#[cfg(feature = "raytrace-cpu")]
+#[test]
+fn render_uses_typed_cpu_setups_from_scripts_and_saved_designs() {
+    for options in [json!({}), json!({"progressive":{"samples_per_pixel":3,"seed":81},"lights":[]})] {
+        let dir = Scratch::new();
+        let script = render_setup_script(&dir, json!({"method":"cpu_raytrace","options":options}));
+        let image = dir.0.join("script.png");
+        let result = json_output(
+            cli()
+                .arg("render")
+                .arg(&script)
+                .args(["--setup", "Portable setup", "--out"])
+                .arg(&image)
+                .env("SOLIDCRAFT_GPU", "must-not-be-read-for-cpu")
+                .output()
+                .unwrap(),
+        );
+        assert_eq!(result["preflight"]["resolved"]["executor"], "cpu-raytrace");
+        assert_eq!(result["export"]["frame"]["executor"], "cpu-raytrace");
+        assert_eq!(result["preflight"]["request"]["integrator"], "raytrace");
+        assert_eq!(result["preflight"]["request"]["raytrace"].get("progressive"), options.get("progressive"));
+        let png = image::load_from_memory(&std::fs::read(&image).unwrap()).unwrap();
+        assert_eq!((png.width(), png.height()), (16, 16));
+
+        let saved = dir.0.join("portable.solidcraft");
+        json_output(cli().arg("run").arg(&script).arg("--save").arg(&saved).output().unwrap());
+        let original = std::fs::read(&saved).unwrap();
+        let overridden = dir.0.join("overridden.png");
+        let result = json_output(
+            cli()
+                .arg("render")
+                .arg(&saved)
+                .args(["--setup", "Portable setup", "--out"])
+                .arg(&overridden)
+                .args(["--width", "12", "--height", "8", "--exposure", "1.25"])
+                .env("SOLIDCRAFT_GPU", "must-not-be-read-for-cpu")
+                .output()
+                .unwrap(),
+        );
+        assert_eq!(result["preflight"]["request"]["width"], 12);
+        assert_eq!(result["preflight"]["request"]["height"], 8);
+        assert_eq!(result["preflight"]["request"]["raytrace"]["exposure_ev"], 1.25);
+        assert_eq!(result["export"]["frame"]["executor"], "cpu-raytrace");
+        assert_eq!(result["preflight"]["request"]["raytrace"].get("progressive"), options.get("progressive"));
+        let png = image::load_from_memory(&std::fs::read(overridden).unwrap()).unwrap();
+        assert_eq!((png.width(), png.height()), (12, 8));
+        assert_eq!(std::fs::read(saved).unwrap(), original, "CLI overrides must not rewrite saved intent");
+    }
+}
+
+#[test]
+fn render_preserves_typed_raster_and_legacy_runtime_controls() {
+    for job in [Value::Null, json!({"method":"raster","transparent_background":true})] {
+        let dir = Scratch::new();
+        let script = render_setup_script(&dir, job.clone());
+        let out = dir.0.join("raster.png");
+        let mut command = cli();
+        command
+            .arg("render")
+            .arg(&script)
+            .args(["--setup", "Portable setup", "--out"])
+            .arg(&out)
+            .env("SOLIDCRAFT_GPU", "must-not-be-read-for-raster");
+        if job.is_null() {
+            command.arg("--transparent");
+        }
+        let result = json_output(command.output().unwrap());
+        assert_eq!(result["preflight"]["resolved"]["executor"], "cpu-product");
+        assert_eq!(result["export"]["frame"]["executor"], "cpu-product");
+        assert_eq!(result["preflight"]["request"]["transparent_background"], true);
+        assert!(std::fs::read(out).unwrap().starts_with(b"\x89PNG\r\n\x1a\n"));
+    }
+}
+
+#[test]
+fn typed_render_rejects_explicit_runtime_flags_before_gpu_or_option_file_reads() {
+    let dir = Scratch::new();
+    let script = render_setup_script(&dir, json!({"method":"gpu_path","options":{"samples":64,"seed":0}}));
+    let out = dir.0.join("existing.png");
+    std::fs::write(&out, b"previous completed image").unwrap();
+    for flags in [
+        &["--progressive"][..],
+        &["--transparent"][..],
+        &["--samples", "64"][..],
+        &["--max-depth", "8"][..],
+        &["--seed", "0"][..],
+        &["--lighting", "deliberately-missing-lighting.json"][..],
+        &["--tone-map", "reinhard"][..],
+        &["--environment", "deliberately-missing-environment.json"][..],
+    ] {
+        let output = cli()
+            .arg("render")
+            .arg(&script)
+            .args(["--setup", "Portable setup", "--out"])
+            .arg(&out)
+            .arg("--overwrite")
+            .args(flags)
+            .env("SOLIDCRAFT_GPU", "must-not-be-read-for-conflicts")
+            .output()
+            .unwrap();
+        assert_eq!(output.status.code(), Some(1));
+        let error = String::from_utf8_lossy(&output.stderr);
+        assert!(error.contains(&format!("{} cannot accompany a typed saved render setup", flags[0])), "{error}");
+        assert!(output.stdout.is_empty());
+        assert_eq!(std::fs::read(&out).unwrap(), b"previous completed image");
+    }
+}
+
+#[test]
+fn typed_gpu_render_selects_its_host_without_a_progressive_runtime_flag() {
+    // A deliberately invalid policy proves that dispatch reached the GPU host
+    // without depending on an adapter or accepting a CPU fallback. The legacy
+    // --progressive path must still reach that same host-selection boundary.
+    for job in [json!({"method":"gpu_path","options":{"samples":2}}), Value::Null] {
+        let dir = Scratch::new();
+        let script = render_setup_script(&dir, job.clone());
+        let out = dir.0.join("gpu.png");
+        let mut command = cli();
+        command.arg("render").arg(&script).args(["--setup", "Portable setup", "--out"]).arg(&out).env("SOLIDCRAFT_GPU", "not-a-gpu-policy");
+        if job.is_null() {
+            command.arg("--progressive");
+        }
+        let output = command.output().unwrap();
+        assert_eq!(output.status.code(), Some(1));
+        let error = String::from_utf8_lossy(&output.stderr);
+        assert!(error.contains("SOLIDCRAFT_GPU must be auto, hardware, software or cpu"), "{error}");
+        assert!(!out.exists());
+    }
+}
+
+#[test]
+fn render_setup_overrides_obey_shared_validation_before_host_initialization() {
+    let dir = Scratch::new();
+    let script = render_setup_script(&dir, json!({"method":"cpu_raytrace","options":{"progressive":{"samples_per_pixel":64}}}));
+    let out = dir.0.join("invalid.png");
+    // 1024 * 1024 * 64 exceeds the unchanged default Compact camera-sample
+    // budget. Admission must name that envelope before initializing any host.
+    for (flags, message) in [
+        (&["--width", "1024", "--height", "1024"][..], "CPU Compact exceeds its 16777216 camera-sample admission"),
+        (&["--width", "0"][..], "render output must be at least"),
+        (&["--exposure", "NaN"][..], "render exposure must be finite"),
+    ] {
+        let output = cli()
+            .arg("render")
+            .arg(&script)
+            .args(["--setup", "Portable setup", "--out"])
+            .arg(&out)
+            .args(flags)
+            .env("SOLIDCRAFT_GPU", "must-not-be-read-for-invalid-settings")
+            .output()
+            .unwrap();
+        assert_eq!(output.status.code(), Some(1));
+        let error = String::from_utf8_lossy(&output.stderr);
+        assert!(error.contains(message), "{error}");
+        assert!(!out.exists());
+    }
+}

apps/solidcraft-cli/tests/script_roundtrip.rs

@@ -84,3 +84,42 @@ fn corpus_designs_replay_from_their_scripts() {
     }
     assert!(replayed >= 7, "replayed {replayed} corpus designs");
 }
+
+/// #1990: a sketch and its extrude may share a name, and the design's script still replays,
+/// keeping the names: the replayed design's own script has the same steps.
+#[test]
+fn a_design_naming_a_sketch_and_its_extrude_alike_replays_from_its_script() {
+    let dir = std::env::temp_dir().join(format!("solidcraft-shared-names-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let cli = |args: &[&std::ffi::OsStr]| {
+        let out = std::process::Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(args).output().unwrap();
+        assert!(
+            out.status.success(),
+            "{}: {}",
+            args.iter().map(|a| a.to_string_lossy()).collect::<Vec<_>>().join(" "),
+            String::from_utf8_lossy(&out.stderr)
+        );
+    };
+    let script = dir.join("mini.json");
+    let saved = dir.join("mini.solidcraft");
+    let exported = dir.join("rt.json");
+    let replayed = dir.join("rt.solidcraft");
+    let again = dir.join("rt2.json");
+    let commands = json!({"commands": [
+        {"command": "sketch.create", "params": {"plane": "XY", "name": "Block"}},
+        {"command": "sketch.rectangle.two_point", "params": {"p0": [0, 0], "p1": [20, 10]}},
+        {"command": "sketch.finish", "params": {}},
+        {"command": "solid.extrude", "params": {"distance": "5", "name": "Block"}},
+    ]});
+    std::fs::write(&script, commands.to_string()).unwrap();
+    cli(&["run".as_ref(), script.as_ref(), "--save".as_ref(), saved.as_ref()]);
+    cli(&["script".as_ref(), saved.as_ref(), "--out".as_ref(), exported.as_ref()]);
+    cli(&["run".as_ref(), exported.as_ref(), "--save".as_ref(), replayed.as_ref()]);
+    cli(&["script".as_ref(), replayed.as_ref(), "--out".as_ref(), again.as_ref()]);
+    let first: Value = serde_json::from_str(&std::fs::read_to_string(&exported).unwrap()).unwrap();
+    let second: Value = serde_json::from_str(&std::fs::read_to_string(&again).unwrap()).unwrap();
+    let _ = std::fs::remove_dir_all(&dir);
+    let names: Vec<&str> = first["commands"].as_array().unwrap().iter().filter_map(|c| c["params"]["feature"]["name"].as_str()).collect();
+    assert_eq!(names, ["Block", "Block"], "{first:#}");
+    assert_eq!(second["commands"], first["commands"], "the replayed design's script has the same steps");
+}

apps/solidcraft-cli/tests/snapshot_appearance.rs

@@ -0,0 +1,221 @@
+//! `snapshot --body`, `--tool` and `--section`: a picture of a tool body inside the material it
+//! meets, which is the one picture that says whether a cut reaches through.
+//!
+//! Each option is a shortcut for the command the app itself runs (`appearance.assign`,
+//! `inspect.section`), so every test here asserts that the option's picture is the picture of a
+//! script that runs those commands — not that the pixels match a stored image. Pictures are
+//! compared with a tolerance, and the tests run on whatever renderer the machine has (a GPU, a
+//! software adapter, or the CPU rasterizer), because they only ever compare two pictures this
+//! same CLI drew.
+
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output};
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+use serde_json::{Value, json};
+
+static NEXT: AtomicUsize = AtomicUsize::new(0);
+
+const SIZE: (u32, u32) = (200, 140);
+
+/// A PNG's size and RGBA pixels.
+fn decode(png: &[u8]) -> (u32, u32, Vec<u8>) {
+    let img = image::load_from_memory_with_format(png, image::ImageFormat::Png).unwrap().to_rgba8();
+    (img.width(), img.height(), img.into_raw())
+}
+
+/// Pixels of two same-sized pictures that differ by more than a little in some channel.
+fn differing(a: &[u8], b: &[u8]) -> usize {
+    let ((wa, ha, a), (wb, hb, b)) = (decode(a), decode(b));
+    assert_eq!((wa, ha), (wb, hb), "pictures of different sizes");
+    a.as_chunks::<4>().0.iter().zip(b.as_chunks::<4>().0).filter(|(p, q)| p.iter().zip(q.iter()).any(|(x, y)| x.abs_diff(*y) > 16)).count()
+}
+
+/// The same picture: a renderer's output may differ by a few levels or a stray edge pixel.
+#[track_caller]
+fn assert_same(a: &[u8], b: &[u8], what: &str) {
+    let (n, total) = (differing(a, b), (SIZE.0 * SIZE.1) as usize);
+    assert!(n * 500 <= total, "{what}: {n} of {total} pixels differ");
+}
+
+/// Different pictures: more than stray pixels differ.
+#[track_caller]
+fn assert_differs(a: &[u8], b: &[u8], what: &str) {
+    let n = differing(a, b);
+    assert!(n >= 100, "{what}: only {n} pixels differ");
+}
+
+/// How much of a picture is the tool colour (`preview::TOOL_COLOR`, #e8542c): a red neither
+/// the default body grey nor the background has, still recognisable once a see-through body in
+/// front of it has tinted it (measured on this machine: (200, 108, 85) through a target at
+/// opacity 0.3, against (164, 173, 184) for the plain grey).
+fn tool_pixels(png: &[u8]) -> usize {
+    let (_, _, px) = decode(png);
+    px.as_chunks::<4>().0.iter().filter(|p| p[0] > 140 && p[0] > p[1].saturating_add(50) && p[0] > p[2].saturating_add(50)).count()
+}
+
+struct Scratch(PathBuf);
+
+impl Scratch {
+    fn new() -> Self {
+        let dir =
+            std::env::temp_dir().join(format!("solidcraft-snapshot-appearance-{}-{}", std::process::id(), NEXT.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir(&dir).unwrap();
+        Self(dir)
+    }
+
+    /// A plate with a pin standing in it: the tool body a cut would remove, reaching 6 mm short
+    /// of the far face, which is exactly what a picture is supposed to show and a volume is not.
+    /// `more` runs on top.
+    fn script(&self, name: &str, more: &[Value]) -> PathBuf {
+        let mut steps = vec![
+            json!({"command": "solid.box", "params": {"length": 50, "width": 34, "height": 20, "center": [0, 0, 10], "body_name": "Target"}}),
+            json!({"command": "solid.cylinder", "params": {"diameter": 12, "height": 14, "base": [0, 0, 0], "operation": "new_body", "body_name": "Tool"}}),
+        ];
+        steps.extend(more.iter().cloned());
+        let path = self.0.join(name);
+        std::fs::write(&path, json!({"commands": steps}).to_string()).unwrap();
+        path
+    }
+
+    fn run(&self, script: &Path, out: &str, extra: &[&str]) -> Output {
+        let (w, h) = (SIZE.0.to_string(), SIZE.1.to_string());
+        Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+            .arg("snapshot")
+            .arg(script)
+            .arg("--out")
+            .arg(self.0.join(out))
+            .args(["--width", &w, "--height", &h, "--no-grid", "--no-axes"])
+            .args(extra)
+            .output()
+            .unwrap()
+    }
+
+    /// The PNG `snapshot` writes.
+    fn snapshot(&self, script: &Path, out: &str, extra: &[&str]) -> Vec<u8> {
+        let output = self.run(script, out, extra);
+        assert!(output.status.success(), "{extra:?}: {}", String::from_utf8_lossy(&output.stderr));
+        let png = std::fs::read(self.0.join(out)).unwrap();
+        assert!(png.starts_with(b"\x89PNG"), "{extra:?}");
+        png
+    }
+}
+
+impl Drop for Scratch {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+/// `--body NAME:opacity=…` draws that body see-through, and the picture is the one a script
+/// gets by assigning the same appearance itself: the option is the command, not a second way
+/// of drawing.
+#[test]
+fn a_body_drawn_see_through_is_the_picture_of_the_same_appearance_assigned() {
+    let dir = Scratch::new();
+    let plain = dir.script("plain.json", &[]);
+    let assigned =
+        dir.script("assigned.json", &[json!({"command": "appearance.assign", "params": {"bodies": ["Target"], "color": "#b0bac6", "opacity": 0.3}})]);
+    let solid = dir.snapshot(&plain, "solid.png", &[]);
+    let see_through = dir.snapshot(&plain, "see-through.png", &["--body", "Target:opacity=0.3"]);
+    assert_differs(&see_through, &solid, "--body opacity was ignored");
+    assert_same(&see_through, &dir.snapshot(&assigned, "by-script.png", &[]), "the same appearance assigned by a script");
+
+    // The option's colour is the design's too. It names the target, not the tool: the tool is
+    // inside the target, so a solid target hides whatever colour the tool is given.
+    let painted =
+        dir.script("painted.json", &[json!({"command": "appearance.assign", "params": {"bodies": ["Target"], "color": "#00aa33", "opacity": 1.0}})]);
+    let by_option = dir.snapshot(&plain, "painted.png", &["--body", "Target:color=#00aa33"]);
+    assert_differs(&by_option, &solid, "--body color was ignored");
+    assert_same(&by_option, &dir.snapshot(&painted, "painted-script.png", &[]), "the same colour assigned by a script");
+}
+
+/// `--tool NAME` is the whole point: the tool solid in the tool colour, every other body
+/// see-through, so the tool shows inside the material it meets. The tool's colour covers more
+/// of the picture than it does without the option, because the target no longer hides it.
+#[test]
+fn a_tool_shows_through_the_bodies_around_it() {
+    let dir = Scratch::new();
+    let script = dir.script("part.json", &[]);
+    let plain = dir.snapshot(&script, "plain.png", &["--view", "front"]);
+    let preview = dir.snapshot(&script, "preview.png", &["--view", "front", "--tool", "Tool"]);
+    assert_differs(&preview, &plain, "--tool was ignored");
+    // Seen from the front the plate hides the pin completely; the preview shows all of it.
+    assert_eq!(tool_pixels(&plain), 0, "nothing is the tool colour before the option");
+    assert!(tool_pixels(&preview) > 200, "the tool shows through the target: {} pixels", tool_pixels(&preview));
+
+    // It is the two commands it stands for, run in that order.
+    let by_script = dir.script(
+        "by-script.json",
+        &[
+            json!({"command": "appearance.assign", "params": {"bodies": ["Target"], "color": "#b0bac6", "opacity": 0.3}}),
+            json!({"command": "appearance.assign", "params": {"bodies": ["Tool"], "color": "#e8542c", "opacity": 1.0}}),
+        ],
+    );
+    assert_same(&preview, &dir.snapshot(&by_script, "script.png", &["--view", "front"]), "the appearances --tool assigns");
+
+    // A later --body overrides what --tool said.
+    let overridden = dir.snapshot(&script, "override.png", &["--view", "front", "--tool", "Tool", "--body", "Tool:color=#2255cc"]);
+    assert!(tool_pixels(&overridden) < 50, "--body after --tool decides the tool's colour");
+}
+
+/// `--section` cuts the model where `inspect.section` would, and the same spec written as the
+/// command's own JSON, or as the command in a script, gives the same picture.
+#[test]
+fn a_section_cuts_the_model_as_inspect_section_does() {
+    let dir = Scratch::new();
+    let script = dir.script("part.json", &[]);
+    let whole = dir.snapshot(&script, "whole.png", &[]);
+    let cut = dir.snapshot(&script, "cut.png", &["--section", "z=12"]);
+    assert_differs(&cut, &whole, "--section was ignored");
+    assert_same(&cut, &dir.snapshot(&script, "cut-json.png", &["--section", r#"{"plane": "XY", "at": 12}"#]), "the command's own JSON");
+    let by_script = dir.script("sectioned.json", &[json!({"command": "inspect.section", "params": {"plane": "XY", "at": 12}})]);
+    assert_same(&cut, &dir.snapshot(&by_script, "by-script.png", &[]), "inspect.section in a script");
+
+    // The other side of the same plane is a different picture.
+    let flipped = dir.snapshot(&script, "flipped.png", &["--section", "z=12,flip"]);
+    assert_differs(&flipped, &cut, "flip keeps the other side");
+
+    // A section through a see-through target still shows the tool inside it.
+    let both = dir.snapshot(&script, "both.png", &["--section", "z=12", "--tool", "Tool"]);
+    assert_differs(&both, &cut, "--tool and --section together");
+    assert!(tool_pixels(&both) > 100, "the tool is in the cut picture");
+}
+
+/// Every way of getting the options wrong is an error that says what it takes, and writes no
+/// picture: a snapshot that quietly ignored an option would be a lie about the design.
+#[test]
+fn a_body_tool_or_section_that_cannot_be_used_is_an_error_and_writes_nothing() {
+    let dir = Scratch::new();
+    let script = dir.script("part.json", &[]);
+    let cases: [(&[&str], &str); 8] = [
+        (&["--body", "Nowhere:opacity=0.3"], "no body `Nowhere`"),
+        (&["--body", "Target"], "NAME:key=value"),
+        (&["--body", "Target:opacity=3"], "0 to 1"),
+        (&["--body", "Target:alpha=0.3"], "unknown key `alpha`"),
+        (&["--body", "Target:color=red"], "#rrggbb"),
+        (&["--tool", "Nowhere"], "no body `Nowhere`"),
+        (&["--section", "q=1"], "unknown axis `q`"),
+        (&["--section", "nonsense"], "z=27"),
+    ];
+    for (extra, expect) in cases {
+        let output = dir.run(&script, "never.png", extra);
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        assert_eq!(output.status.code(), Some(1), "{extra:?}: {stderr}");
+        assert!(stderr.contains(expect), "{extra:?}: {stderr}");
+        assert!(output.stdout.is_empty() && !dir.0.join("never.png").exists(), "{extra:?}");
+    }
+    // An error naming a body says which bodies the design has.
+    let stderr = String::from_utf8_lossy(&dir.run(&script, "never.png", &["--tool", "Nowhere"]).stderr).to_string();
+    assert!(stderr.contains("Target") && stderr.contains("Tool"), "{stderr}");
+}
+
+/// The usage text says what the options do.
+#[test]
+fn the_usage_names_the_body_tool_and_section_options() {
+    let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).arg("snapshot").output().unwrap();
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    for word in ["--body", "--tool", "--section", "appearance.assign", "inspect.section", "see-through"] {
+        assert!(stderr.contains(word), "usage lacks {word}: {stderr}");
+    }
+}

apps/solidcraft-web/Cargo.toml

@@ -13,11 +13,16 @@ workspace = true
 name = "solidcraft-web"
 path = "src/main.rs"
 
+[features]
+default = []
+bundled-render-library = ["solidcraft-engine/bundled-render-library"]
+
 [dependencies]
 solidcraft-engine = { workspace = true }
 solidcraft-ui-egui = { workspace = true }
 egui = { workspace = true }
 log = { workspace = true }
+url = "2"
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit"] }
@@ -29,5 +34,7 @@ web-sys = { version = "0.3", features = [
     "Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "Location", "Navigator", "StorageManager",
     "FileSystemHandle", "FileSystemDirectoryHandle", "FileSystemFileHandle", "FileSystemGetFileOptions", "FileSystemWritableFileStream",
     "WritableStream", "File", "FileList", "Blob", "BlobPropertyBag", "Url", "HtmlAnchorElement", "HtmlInputElement", "Storage",
-    "BeforeUnloadEvent", "Event", "EventTarget", "Response", "MediaQueryList", "Gamepad", "Performance",
+    "IdbFactory", "IdbDatabase", "IdbObjectStore", "IdbOpenDbRequest", "IdbRequest", "IdbTransaction", "IdbTransactionMode",
+    "Headers", "ReadableStream", "ReadableStreamDefaultReader",
+    "BeforeUnloadEvent", "Event", "EventTarget", "KeyboardEvent", "Response", "MediaQueryList", "Gamepad", "Performance",
 ] }

apps/solidcraft-web/src/disk.rs

@@ -0,0 +1,637 @@
+//! Designs on the computer's own disk, through the File System Access API (Chrome, Edge, Opera):
+//! Save As and Open show the browser's file dialogs, and the chosen file's handle is kept (in
+//! memory, and in IndexedDB so Save still reaches the file after a reload) so Save writes back to
+//! it. To the engine such a design is the file `/disk/<id>/<name>`: it saves there like anywhere,
+//! and [`flush`](crate::files::flush) forwards what it wrote to the handle. Browsers without the
+//! API (Firefox, Safari) keep designs in the origin private file system (`files.rs`).
+//!
+//! The path logic is plain Rust and tested natively; the browser calls are wasm-only.
+#![cfg_attr(not(target_arch = "wasm32"), allow(dead_code))]
+
+/// Where a design on the computer's disk appears to the engine.
+pub const PREFIX: &str = "/disk/";
+
+/// Where designs kept in the browser's private storage (OPFS) appear to the engine.
+pub const OPFS_PREFIX: &str = "/opfs/";
+/// Paths written here are handed to the user as downloads.
+pub const DOWNLOADS_PREFIX: &str = "/downloads/";
+
+/// Where what a command wrote to an engine path goes.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum WriteTo {
+    /// The browser's private storage: the design (or recovery file) keeps its name there.
+    Opfs,
+    /// A file on the computer, through its handle.
+    Disk,
+    /// A download.
+    Download,
+    /// Kept only in memory (uploads).
+    Memory,
+}
+
+/// Route a write by its path. OPFS paths always go to OPFS, whatever the browser can do: a design
+/// opened from the browser's storage keeps saving there until the user picks Save As.
+pub fn route(path: &str) -> WriteTo {
+    if path.starts_with(OPFS_PREFIX) {
+        WriteTo::Opfs
+    } else if parse(path).is_some() {
+        WriteTo::Disk
+    } else if path.starts_with(DOWNLOADS_PREFIX) {
+        WriteTo::Download
+    } else {
+        WriteTo::Memory
+    }
+}
+
+/// The engine path of the design `name` kept under handle `id`.
+pub fn path(id: &str, name: &str) -> String {
+    format!("{PREFIX}{id}/{name}")
+}
+
+/// The handle id and file name of an engine path made by [`path`].
+pub fn parse(path: &str) -> Option<(&str, &str)> {
+    let (id, name) = path.strip_prefix(PREFIX)?.split_once('/')?;
+    (!id.is_empty() && !name.is_empty() && !name.contains('/')).then_some((id, name))
+}
+
+/// A handle id from the time and a random number.
+pub fn make_id(ms: u64, random: u64) -> String {
+    format!("{ms:x}-{random:x}")
+}
+
+/// How long a remembered file may go unused, and unreferenced by the recent designs and the
+/// autosave, before the browser's copy of its handle is dropped.
+pub const HANDLE_MAX_AGE_MS: f64 = 90.0 * 24.0 * 3600.0 * 1000.0;
+
+/// What to do with the remembered handles.
+#[derive(Debug, Default, PartialEq)]
+pub struct PrunePlan {
+    /// Handles to forget.
+    pub delete: Vec<String>,
+    /// Handles seen unused for the first time: start their clock.
+    pub stamp: Vec<String>,
+}
+
+/// Decide which of the remembered handles `ids` (id, when it was last stamped) to forget: those
+/// that no recent design or autosave (`keep`) names and that have gone unused for `max_age`. One
+/// never stamped starts its clock now, so a file another tab has just saved is never dropped.
+pub fn plan_prune(ids: &[(String, Option<f64>)], keep: &std::collections::HashSet<String>, now: f64, max_age: f64) -> PrunePlan {
+    let mut plan = PrunePlan::default();
+    for (id, stamped) in ids.iter().filter(|(id, _)| !keep.contains(id)) {
+        match stamped {
+            None => plan.stamp.push(id.clone()),
+            Some(at) if now - at > max_age => plan.delete.push(id.clone()),
+            Some(_) => {}
+        }
+    }
+    plan
+}
+
+/// Where a design saved with Save As goes.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum SaveTarget {
+    /// A file the user picks on their computer.
+    Disk,
+    /// The browser's private storage (OPFS): what browsers without the API have always done.
+    Browser,
+    /// Not a design (an export): handed over as a download.
+    Download,
+}
+
+/// Choose where a Save As goes: designs to the disk when the browser can pick a file, else into
+/// the browser's storage; anything else is a download.
+pub fn save_target(api: bool, design: bool) -> SaveTarget {
+    match (design, api) {
+        (false, _) => SaveTarget::Download,
+        (true, true) => SaveTarget::Disk,
+        (true, false) => SaveTarget::Browser,
+    }
+}
+
+/// Does a picker for `extensions` (what the command reads; `&[]`: anything) belong to a design?
+/// Only those go through the disk dialog; inserting a STEP or mesh keeps using the file window.
+pub fn opens_design(extensions: &[&str]) -> bool {
+    extensions.is_empty() || extensions.iter().any(|e| solidcraft_engine::io::DESIGN_EXTS.contains(e))
+}
+
+/// The file type a Save As dialog offers for `name`: (description, MIME type, extension).
+pub fn save_type(name: &str) -> (&'static str, &'static str, &'static str) {
+    let json = std::path::Path::new(name).extension().is_some_and(|e| e.eq_ignore_ascii_case("json"));
+    if json { ("Plain JSON design", "application/json", ".json") } else { ("SolidCraft design", "application/octet-stream", ".solidcraft") }
+}
+
+/// Is this a cancelled dialog (the browser's `AbortError`)? Not an error to show.
+pub fn is_abort(error_name: &str) -> bool {
+    error_name == "AbortError"
+}
+
+#[cfg(target_arch = "wasm32")]
+pub use web::*;
+
+#[cfg(target_arch = "wasm32")]
+mod web {
+    use std::cell::{Cell, RefCell};
+    use std::collections::{HashMap, VecDeque};
+    use std::rc::Rc;
+
+    use js_sys::{Array, Function, Object, Promise, Reflect};
+    use solidcraft_engine::io::vfs;
+    use wasm_bindgen::{JsCast as _, JsValue, closure::Closure};
+    use wasm_bindgen_futures::{JsFuture, spawn_local};
+    use web_sys::{FileSystemFileHandle, IdbDatabase, IdbObjectStore, IdbOpenDbRequest, IdbRequest, IdbTransactionMode};
+
+    use super::{HANDLE_MAX_AGE_MS, is_abort, make_id, opens_design, parse, path, plan_prune, save_type};
+    use crate::files::{Files, err, read_handle};
+
+    const DB: &str = "solidcraft-disk-handles";
+    const STORE: &str = "handles";
+
+    thread_local! {
+        /// Handles picked or looked up in this session, by id.
+        static HANDLES: RefCell<HashMap<String, FileSystemFileHandle>> = RefCell::new(HashMap::new());
+        /// Writes waiting for their turn (a file takes one writer at a time), latest per id.
+        static QUEUE: RefCell<VecDeque<(String, Vec<u8>)>> = const { RefCell::new(VecDeque::new()) };
+        static BUSY: Cell<bool> = const { Cell::new(false) };
+    }
+
+    /// Why a dialog gave no file.
+    enum Pick {
+        Cancelled,
+        Failed(String),
+    }
+
+    fn failed(e: JsValue) -> Pick {
+        let name = Reflect::get(&e, &"name".into()).ok().and_then(|n| n.as_string()).unwrap_or_default();
+        if is_abort(&name) { Pick::Cancelled } else { Pick::Failed(err(e)) }
+    }
+
+    /// Can this page show the browser's file dialogs and write to the files they pick?
+    pub fn supported() -> bool {
+        let Some(window) = web_sys::window() else { return false };
+        let has = |name: &str| Reflect::get(&window, &name.into()).is_ok_and(|f| f.is_function());
+        window.is_secure_context() && has("showSaveFilePicker") && has("showOpenFilePicker")
+    }
+
+    fn types(description: &str, mime: &str, extension: &str) -> Array {
+        let accept = Object::new();
+        let _ = Reflect::set(&accept, &mime.into(), &Array::of1(&extension.into()));
+        let entry = Object::new();
+        let _ = Reflect::set(&entry, &"description".into(), &description.into());
+        let _ = Reflect::set(&entry, &"accept".into(), &accept);
+        Array::of1(&entry)
+    }
+
+    /// Start a dialog. This must run in the click that asked for it (the browser wants a user
+    /// gesture), so it is called before anything is awaited.
+    fn start_picker(function: &str, options: &Object) -> Result<Promise, Pick> {
+        let window = web_sys::window().ok_or_else(|| Pick::Failed("no window".into()))?;
+        let f: Function = Reflect::get(&window, &function.into())
+            .map_err(failed)?
+            .dyn_into()
+            .map_err(|_| Pick::Failed("this browser can't open file dialogs".into()))?;
+        f.call1(&window, options).map_err(failed)?.dyn_into().map_err(|_| Pick::Failed("no answer from the file dialog".into()))
+    }
+
+    /// Remember a picked file: in memory now, in IndexedDB for the next session.
+    fn register(handle: &FileSystemFileHandle) -> String {
+        let id = make_id(js_sys::Date::now() as u64, (js_sys::Math::random() * 1e15) as u64);
+        HANDLES.with(|h| h.borrow_mut().insert(id.clone(), handle.clone()));
+        let (key, kept, name) = (id.clone(), handle.clone(), handle.name());
+        spawn_local(async move {
+            if let Err(e) = remember(&key, &kept).await {
+                log::warn!("the file's handle isn't kept for the next session: {e}");
+            }
+        });
+        path(&id, &name)
+    }
+
+    fn save_options(name: &str) -> Object {
+        let options = Object::new();
+        let _ = Reflect::set(&options, &"suggestedName".into(), &name.into());
+        let (description, mime, extension) = save_type(name);
+        let _ = Reflect::set(&options, &"types".into(), &types(description, mime, extension));
+        options
+    }
+
+    /// "Save to computer…" for a design kept in the browser: write a copy of `bytes` to a file the
+    /// user picks (call in the click), or download it where the browser can't pick one. The design
+    /// itself stays where it is.
+    pub fn save_copy(files: &Rc<Files>, name: &str, bytes: Vec<u8>) {
+        if !supported() {
+            if let Err(e) = crate::files::download(name, &bytes) {
+                files.say(format!("{name}: {e}"), true);
+            }
+            return;
+        }
+        let promise = start_picker("showSaveFilePicker", &save_options(name));
+        let files = files.clone();
+        spawn_local(async move {
+            let r = async {
+                let h: FileSystemFileHandle =
+                    JsFuture::from(promise?).await.map_err(failed)?.dyn_into().map_err(|_| Pick::Failed("not a file".into()))?;
+                write_handle(&h, &bytes).await.map_err(Pick::Failed)?;
+                Ok::<String, Pick>(h.name())
+            };
+            match r.await {
+                Ok(saved) => files.say(format!("Saved a copy to {saved}"), false),
+                Err(Pick::Cancelled) => {}
+                Err(Pick::Failed(e)) => files.say(format!("save to computer: {e}"), true),
+            }
+        });
+    }
+
+    /// Save As, step one: show the browser's save dialog (call in the click). The answer is the
+    /// engine path the design is saved to, `None` when the dialog was closed.
+    pub fn pick_save(files: &Rc<Files>, name: &str) -> impl std::future::Future<Output = Option<String>> + use<> {
+        let promise = start_picker("showSaveFilePicker", &save_options(name));
+        let files = files.clone();
+        async move {
+            let handle = match promise {
+                Ok(p) => JsFuture::from(p)
+                    .await
+                    .map_err(failed)
+                    .and_then(|h| h.dyn_into::<FileSystemFileHandle>().map_err(|_| Pick::Failed("not a file".into()))),
+                Err(e) => Err(e),
+            };
+            match handle {
+                Ok(h) => Some(register(&h)),
+                Err(Pick::Cancelled) => None,
+                Err(Pick::Failed(e)) => {
+                    files.say(format!("save: {e}"), true);
+                    None
+                }
+            }
+        }
+    }
+
+    /// Open, step one: show the browser's open dialog for a design (call in the click). The
+    /// answer is the engine path of the file, read into the engine's files; a design keeps its
+    /// handle, so Save writes back to the file. `None`: closed, or it could not be read.
+    pub fn pick_open(files: &Rc<Files>) -> impl std::future::Future<Output = Option<String>> + use<> {
+        let promise = start_picker("showOpenFilePicker", &open_options());
+        let files = files.clone();
+        async move {
+            let r = async {
+                let p = promise?;
+                let handles: Array = JsFuture::from(p).await.map_err(failed)?.dyn_into().map_err(|_| Pick::Failed("no file".into()))?;
+                let h: FileSystemFileHandle = handles.get(0).dyn_into().map_err(|_| Pick::Cancelled)?;
+                let bytes = read_handle(&h).await.map_err(Pick::Failed)?;
+                Ok((h, bytes))
+            };
+            match r.await {
+                Ok((h, bytes)) => Some(arrive(&h, bytes)),
+                Err(Pick::Cancelled) => None,
+                Err(Pick::Failed(e)) => {
+                    files.say(format!("open: {e}"), true);
+                    None
+                }
+            }
+        }
+    }
+
+    /// The options of the open dialog: a single file, designs and CAD files listed first.
+    pub fn open_options() -> Object {
+        let options = Object::new();
+        let _ = Reflect::set(&options, &"multiple".into(), &JsValue::FALSE);
+        let extensions = Array::new();
+        for e in [".solidcraft", ".solvecraft", ".json", ".step", ".stp", ".3mf", ".stl", ".obj", ".glb", ".gltf", ".fcstd", ".3dm"] {
+            extensions.push(&e.into());
+        }
+        let accept = Object::new();
+        let _ = Reflect::set(&accept, &"application/octet-stream".into(), &extensions);
+        let entry = Object::new();
+        let _ = Reflect::set(&entry, &"description".into(), &"Designs and CAD files".into());
+        let _ = Reflect::set(&entry, &"accept".into(), &accept);
+        let _ = Reflect::set(&options, &"types".into(), &Array::of1(&entry));
+        options
+    }
+
+    /// A file read from a dialog's handle: a design lives at its disk path from now on (and
+    /// keeps the handle); anything else is an upload to open or insert.
+    pub fn arrive(handle: &FileSystemFileHandle, bytes: Vec<u8>) -> String {
+        let name = handle.name();
+        let p = if solidcraft_engine::io::is_design_path(&name) { register(handle) } else { format!("{}{name}", crate::files::UPLOAD) };
+        vfs::insert(&p, bytes);
+        p
+    }
+
+    /// Does an Open for `extensions` use the browser's open dialog?
+    pub fn handles_open(extensions: &[&str]) -> bool {
+        supported() && opens_design(extensions)
+    }
+
+    // ---- writing ------------------------------------------------------------------------
+
+    /// Queue what a command wrote to a disk path. Writes go one at a time; a newer write of the
+    /// same file replaces one still waiting.
+    pub fn enqueue(files: &Rc<Files>, path: &str, bytes: Vec<u8>) {
+        QUEUE.with(|q| {
+            let mut q = q.borrow_mut();
+            q.retain(|(p, _)| p != path);
+            q.push_back((path.to_string(), bytes));
+        });
+        if BUSY.with(|b| b.replace(true)) {
+            return;
+        }
+        let files = files.clone();
+        spawn_local(async move {
+            while let Some((path, bytes)) = QUEUE.with(|q| q.borrow_mut().pop_front()) {
+                if let Err(e) = write(&path, &bytes).await {
+                    files.failed_disk(&path, &e);
+                }
+            }
+            BUSY.with(|b| b.set(false));
+        });
+    }
+
+    async fn write(path: &str, bytes: &[u8]) -> Result<(), String> {
+        let (id, name) = parse(path).ok_or("not a file on the computer")?;
+        let handle = handle_for(id).await.map_err(|e| format!("{name}: {e}"))?;
+        write_handle(&handle, bytes).await.map_err(|e| format!("{name}: {e}"))
+    }
+
+    async fn write_handle(handle: &FileSystemFileHandle, bytes: &[u8]) -> Result<(), String> {
+        ensure_readwrite(handle).await?;
+        let w: web_sys::FileSystemWritableFileStream =
+            JsFuture::from(handle.create_writable()).await.map_err(err)?.dyn_into().map_err(|_| "no writable stream".to_string())?;
+        JsFuture::from(w.write_with_u8_array(bytes).map_err(err)?).await.map_err(err)?;
+        JsFuture::from(w.close()).await.map_err(err)?;
+        Ok(())
+    }
+
+    async fn handle_for(id: &str) -> Result<FileSystemFileHandle, String> {
+        if let Some(h) = HANDLES.with(|h| h.borrow().get(id).cloned()) {
+            return Ok(h);
+        }
+        let h: FileSystemFileHandle = recall(id)
+            .await?
+            .and_then(|v| v.dyn_into().ok())
+            .ok_or("the browser no longer remembers where this design was saved: use Save As to choose the file again")?;
+        HANDLES.with(|m| m.borrow_mut().insert(id.to_string(), h.clone()));
+        Ok(h)
+    }
+
+    /// Ask for write access if the browser doesn't hold it any more (after a reload): one prompt,
+    /// from the click that asked for the save.
+    async fn ensure_readwrite(handle: &FileSystemFileHandle) -> Result<(), String> {
+        let options = Object::new();
+        let _ = Reflect::set(&options, &"mode".into(), &"readwrite".into());
+        for method in ["queryPermission", "requestPermission"] {
+            let Some(f) = Reflect::get(handle, &method.into()).ok().and_then(|f| f.dyn_into::<Function>().ok()) else {
+                // A browser without the permission calls hands out writable handles as they are.
+                return Ok(());
+            };
+            let answer = f.call1(handle, &options).map_err(err)?;
+            let state = JsFuture::from(Promise::resolve(&answer)).await.map_err(err)?;
+            if state.as_string().as_deref() == Some("granted") {
+                return Ok(());
+            }
+        }
+        Err("the browser wasn't given permission to write the file: use Save As to choose it again".into())
+    }
+
+    // ---- IndexedDB: the handles, by id --------------------------------------------------
+
+    /// The result of an IndexedDB request.
+    async fn result(req: &IdbRequest) -> Result<JsValue, String> {
+        let promise = Promise::new(&mut |resolve, reject| {
+            let r = req.clone();
+            let ok = Closure::once_into_js(move || {
+                let _ = resolve.call1(&JsValue::NULL, &r.result().unwrap_or(JsValue::UNDEFINED));
+            });
+            let bad = Closure::once_into_js(move || {
+                let _ = reject.call1(&JsValue::NULL, &"IndexedDB failed".into());
+            });
+            req.set_onsuccess(Some(ok.unchecked_ref()));
+            req.set_onerror(Some(bad.unchecked_ref()));
+        });
+        JsFuture::from(promise).await.map_err(err)
+    }
+
+    async fn open_db() -> Result<IdbDatabase, String> {
+        let factory = web_sys::window().ok_or("no window")?.indexed_db().map_err(err)?.ok_or("this browser has no IndexedDB")?;
+        let request: IdbOpenDbRequest = factory.open_with_u32(DB, 1).map_err(err)?;
+        let target = request.clone();
+        let upgrade = Closure::once_into_js(move || {
+            if let Ok(db) = target.result().and_then(|r| r.dyn_into::<IdbDatabase>()) {
+                let _ = db.create_object_store(STORE);
+            }
+        });
+        request.set_onupgradeneeded(Some(upgrade.unchecked_ref()));
+        result(&request).await?.dyn_into().map_err(|_| "no database".to_string())
+    }
+
+    fn store(db: &IdbDatabase, mode: IdbTransactionMode) -> Result<IdbObjectStore, String> {
+        db.transaction_with_str_and_mode(STORE, mode).map_err(err)?.object_store(STORE).map_err(err)
+    }
+
+    /// Key of the time a handle was last used (the handle's own key is its id).
+    fn stamp_key(id: &str) -> String {
+        format!("at:{id}")
+    }
+
+    async fn remember(id: &str, handle: &FileSystemFileHandle) -> Result<(), String> {
+        let db = open_db().await?;
+        let store = store(&db, IdbTransactionMode::Readwrite)?;
+        result(&store.put_with_key(handle, &id.into()).map_err(err)?).await?;
+        result(&store.put_with_key(&js_sys::Date::now().into(), &stamp_key(id).into()).map_err(err)?).await.map(|_| ())
+    }
+
+    /// Note that the file was used now.
+    async fn touch(id: &str) {
+        let Ok(db) = open_db().await else { return };
+        if let Ok(store) = store(&db, IdbTransactionMode::Readwrite)
+            && let Ok(req) = store.put_with_key(&js_sys::Date::now().into(), &stamp_key(id).into())
+        {
+            let _ = result(&req).await;
+        }
+    }
+
+    /// The ids of every remembered file.
+    pub async fn known_ids() -> Result<Vec<String>, String> {
+        let db = open_db().await?;
+        let req = store(&db, IdbTransactionMode::Readonly)?.get_all_keys().map_err(err)?;
+        let keys: Array = result(&req).await?.dyn_into().map_err(|_| "no keys".to_string())?;
+        Ok(keys.iter().filter_map(|k| k.as_string()).filter(|k| !k.starts_with("at:")).collect())
+    }
+
+    async fn forget(ids: &[String]) -> Result<(), String> {
+        let db = open_db().await?;
+        let store = store(&db, IdbTransactionMode::Readwrite)?;
+        for id in ids {
+            result(&store.delete(&id.as_str().into()).map_err(err)?).await?;
+            result(&store.delete(&stamp_key(id).into()).map_err(err)?).await?;
+            HANDLES.with(|h| h.borrow_mut().remove(id));
+        }
+        Ok(())
+    }
+
+    /// Forget the remembered files nothing refers to any more (`keep`: the ids the recent designs
+    /// and the autosave name), once they have gone unused for a long while.
+    pub fn prune(keep: std::collections::HashSet<String>) {
+        spawn_local(async move {
+            let r = async {
+                // A transaction ends when the page awaits anything but its own requests, so each
+                // step opens its own.
+                let known = known_ids().await?;
+                let db = open_db().await?;
+                let reading = store(&db, IdbTransactionMode::Readonly)?;
+                let mut ids = Vec::new();
+                for id in known {
+                    let at = result(&reading.get(&stamp_key(&id).into()).map_err(err)?).await?.as_f64();
+                    ids.push((id, at));
+                }
+                let plan = plan_prune(&ids, &keep, js_sys::Date::now(), HANDLE_MAX_AGE_MS);
+                for id in &plan.stamp {
+                    touch(id).await;
+                }
+                forget(&plan.delete).await
+            };
+            if let Err(e) = r.await {
+                log::warn!("remembered files weren't tidied: {e}");
+            }
+        });
+    }
+
+    /// Open a design remembered from an earlier session (a recent one, after a reload): ask once
+    /// for access to the file (call in the click), read it into the engine's files and queue it
+    /// to open. A file that is gone is forgotten and dropped from the recent designs.
+    pub fn restore(files: &Rc<Files>, path: &str) {
+        let Some((id, name)) = parse(path) else { return };
+        let (files, path, id, name) = (files.clone(), path.to_string(), id.to_string(), name.to_string());
+        spawn_local(async move {
+            let r = async {
+                let handle = handle_for(&id).await?;
+                ensure_readwrite(&handle).await?;
+                read_handle(&handle).await
+            };
+            match r.await {
+                Ok(bytes) => {
+                    vfs::insert(&path, bytes);
+                    files.opened.borrow_mut().push(path);
+                    files.wake();
+                    touch(&id).await;
+                }
+                Err(e) => {
+                    let gone = e.contains("NotFoundError") || e.contains("could not be found") || e.contains("no longer remembers");
+                    if gone {
+                        let _ = forget(std::slice::from_ref(&id)).await;
+                        files.disk_known.borrow_mut().remove(&id);
+                        files.gone.borrow_mut().push(path);
+                        files.say(format!("{name} isn't where it was saved any more"), true);
+                    } else {
+                        files.say(format!("{name}: {e}"), true);
+                    }
+                }
+            }
+        });
+    }
+
+    async fn recall(id: &str) -> Result<Option<JsValue>, String> {
+        let db = open_db().await?;
+        let req = store(&db, IdbTransactionMode::Readonly)?.get(&id.into()).map_err(err)?;
+        Ok(Some(result(&req).await?).filter(|v| !v.is_undefined()))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_disk_path_round_trips_its_handle_id_and_name() {
+        let p = path("18f-2a", "Bracket v2.solidcraft");
+        assert_eq!(p, "/disk/18f-2a/Bracket v2.solidcraft");
+        assert_eq!(parse(&p), Some(("18f-2a", "Bracket v2.solidcraft")));
+    }
+
+    #[test]
+    fn only_disk_paths_parse() {
+        for not in [
+            "/opfs/a.solidcraft",
+            "/downloads/a.step",
+            "/upload/a.step",
+            "/disk/",
+            "/disk/id",
+            "/disk/id/",
+            "/disk//a",
+            "/disk/id/x/y",
+            "a.solidcraft",
+        ] {
+            assert_eq!(parse(not), None, "{not}");
+        }
+    }
+
+    /// Designs already stored in OPFS (and the recovery files) keep saving to OPFS under their own
+    /// names, whether or not the browser can write to the disk.
+    #[test]
+    fn writes_to_opfs_paths_still_go_to_opfs() {
+        for p in
+            ["/opfs/Bracket.solidcraft", "/opfs/Bracket (2).solidcraft", "/opfs/recovery.solidcraft", "/opfs/recovery.json", "/opfs/old.solvecraft"]
+        {
+            assert_eq!(route(p), WriteTo::Opfs, "{p}");
+        }
+        // A design opened from OPFS saves to its own path; only a Save As can pick the disk.
+        assert_eq!(save_target(false, true), SaveTarget::Browser);
+        assert_eq!(route(&format!("{OPFS_PREFIX}Bracket.solidcraft")), WriteTo::Opfs);
+        assert_eq!(route("/disk/18f-2a/Bracket.solidcraft"), WriteTo::Disk);
+        assert_eq!(route("/downloads/part.step"), WriteTo::Download);
+        assert_eq!(route("/upload/part.step"), WriteTo::Memory);
+    }
+
+    #[test]
+    fn only_unreferenced_handles_unused_for_long_are_forgotten() {
+        let keep: std::collections::HashSet<String> = ["recent".to_string()].into();
+        let day = 24.0 * 3600.0 * 1000.0;
+        let now = 1000.0 * day;
+        let ids = vec![
+            ("recent".to_string(), Some(now - 200.0 * day)),
+            ("old".to_string(), Some(now - 100.0 * day)),
+            ("fresh".to_string(), Some(now - 5.0 * day)),
+            ("unstamped".to_string(), None),
+        ];
+        let plan = plan_prune(&ids, &keep, now, HANDLE_MAX_AGE_MS);
+        assert_eq!(plan, PrunePlan { delete: vec!["old".to_string()], stamp: vec!["unstamped".to_string()] });
+        assert_eq!(plan_prune(&[], &keep, now, HANDLE_MAX_AGE_MS), PrunePlan::default());
+    }
+
+    #[test]
+    fn handle_ids_differ_by_time_and_by_chance() {
+        assert_ne!(make_id(1, 5), make_id(2, 5));
+        assert_ne!(make_id(1, 5), make_id(1, 6));
+        assert!(!make_id(0, 0).contains('/'));
+    }
+
+    /// Save As: a design goes to the disk where the browser can pick files and to the browser's
+    /// storage where it cannot (today's behaviour); an export is a download either way.
+    #[test]
+    fn save_as_chooses_between_the_disk_the_browsers_storage_and_a_download() {
+        assert_eq!(save_target(true, true), SaveTarget::Disk);
+        assert_eq!(save_target(false, true), SaveTarget::Browser);
+        assert_eq!(save_target(true, false), SaveTarget::Download);
+        assert_eq!(save_target(false, false), SaveTarget::Download);
+    }
+
+    #[test]
+    fn only_design_opens_use_the_disk_dialog() {
+        assert!(opens_design(&[]));
+        assert!(opens_design(&["solidcraft"]));
+        assert!(opens_design(&["solvecraft"]));
+        assert!(!opens_design(&["step", "stp"]));
+        assert!(!opens_design(&["json"]));
+    }
+
+    #[test]
+    fn the_save_dialog_offers_the_type_of_the_name() {
+        assert_eq!(save_type("Plate.solidcraft").2, ".solidcraft");
+        assert_eq!(save_type("Plate.JSON").2, ".json");
+        assert_eq!(save_type("Plate").2, ".solidcraft");
+    }
+
+    #[test]
+    fn closing_a_dialog_is_not_an_error() {
+        assert!(is_abort("AbortError"));
+        assert!(!is_abort("NotAllowedError"));
+        assert!(!is_abort("SecurityError"));
+    }
+}

apps/solidcraft-web/src/files.rs

@@ -2,22 +2,26 @@
 //! the engine's in-memory files (`solidcraft_engine::io::vfs`) at start, written back whenever a
 //! command writes one. Files come in from the computer through a file picker (the File System
 //! Access API where the browser has it, an `<input type=file>` otherwise) or a drop on the page,
-//! and go out as downloads (exports, and "Download design"). An autosave of unsaved work is kept
-//! in OPFS too and offered again after a reload or a crash.
+//! and go out as downloads (exports, and "Download design"). Where the File System Access API
+//! exists a design also lives on the computer's disk, saved and opened through the browser's file
+//! dialogs (`disk.rs`). An autosave of unsaved work is kept in OPFS and offered again after a
+//! reload or a crash.
 
 use std::cell::{Cell, RefCell};
 use std::rc::Rc;
 
 use js_sys::{Array, Function, Object, Reflect, Uint8Array};
 use solidcraft_engine::io::vfs;
+
+use crate::disk;
 use wasm_bindgen::{JsCast as _, JsValue, closure::Closure};
 use wasm_bindgen_futures::{JsFuture, spawn_local};
 use web_sys::{FileSystemDirectoryHandle, FileSystemFileHandle, FileSystemGetFileOptions, FileSystemWritableFileStream};
 
 /// Where OPFS files appear to the engine.
-pub const OPFS: &str = "/opfs/";
+pub const OPFS: &str = disk::OPFS_PREFIX;
 /// Paths written here are handed to the user as downloads.
-pub const DOWNLOADS: &str = "/downloads/";
+pub const DOWNLOADS: &str = disk::DOWNLOADS_PREFIX;
 /// Files brought in from the computer.
 pub const UPLOAD: &str = "/upload/";
 /// The autosave of unsaved work (in OPFS: `recovery.solidcraft` and `recovery.json`).
@@ -51,6 +55,14 @@ pub struct Files {
     pub entries: RefCell<Vec<Entry>>,
     /// Files read from the computer: (name, bytes, what to do).
     pub incoming: RefCell<Vec<(String, Vec<u8>, Intent)>>,
+    /// Designs opened from the computer's disk: their paths in the engine's files.
+    pub opened: RefCell<Vec<String>>,
+    /// The ids of the files remembered from earlier sessions (see `disk::restore`).
+    pub disk_known: RefCell<std::collections::HashSet<String>>,
+    /// Recent designs whose file is gone: to drop from the recent list.
+    pub gone: RefCell<Vec<String>>,
+    /// Disk designs whose last write failed: they are not saved.
+    pub unsaved: RefCell<Vec<String>>,
     /// Messages for the status line (errors and confirmations).
     pub messages: RefCell<Vec<(String, bool)>>,
     /// The stored designs are loaded (the app may open them).
@@ -64,11 +76,17 @@ pub struct Files {
 }
 
 impl Files {
-    fn say(&self, text: impl Into<String>, error: bool) {
+    pub fn say(&self, text: impl Into<String>, error: bool) {
         self.messages.borrow_mut().push((text.into(), error));
         self.wake();
     }
 
+    /// Writing the design at disk `path` failed: say so, and take its "saved" back.
+    pub fn failed_disk(&self, path: &str, error: &str) {
+        self.unsaved.borrow_mut().push(path.to_string());
+        self.say(format!("Not saved to your computer: {error}"), true);
+    }
+
     /// A file arrived from the computer.
     fn arrive(&self, name: String, bytes: Vec<u8>, intent: Intent) {
         self.incoming.borrow_mut().push((name, bytes, intent));
@@ -76,7 +94,7 @@ impl Files {
     }
 
     /// Run a frame (the app sleeps until something happens).
-    fn wake(&self) {
+    pub fn wake(&self) {
         if let Some(c) = self.ctx.borrow().as_ref() {
             c.request_repaint();
         }
@@ -127,7 +145,7 @@ pub fn local_only() -> bool {
     LOCAL.with(Cell::get)
 }
 
-fn err(e: JsValue) -> String {
+pub(crate) fn err(e: JsValue) -> String {
     e.as_string().or_else(|| Reflect::get(&e, &"message".into()).ok().and_then(|m| m.as_string())).unwrap_or_else(|| format!("{e:?}"))
 }
 
@@ -150,7 +168,7 @@ async fn root() -> Result<FileSystemDirectoryHandle, String> {
     dir.dyn_into::<FileSystemDirectoryHandle>().map_err(|_| "this browser has no private file storage (OPFS)".to_string())
 }
 
-async fn read_handle(h: &FileSystemFileHandle) -> Result<Vec<u8>, String> {
+pub(crate) async fn read_handle(h: &FileSystemFileHandle) -> Result<Vec<u8>, String> {
     let file: web_sys::File = JsFuture::from(h.get_file()).await.map_err(err)?.dyn_into().map_err(|_| "not a file".to_string())?;
     blob_bytes(&file).await
 }
@@ -253,6 +271,10 @@ pub fn start(files: &Rc<Files>) {
     }
     let files = files.clone();
     spawn_local(async move {
+        match disk::known_ids().await {
+            Ok(ids) => files.disk_known.borrow_mut().extend(ids),
+            Err(e) => log::info!("no remembered files: {e}"),
+        }
         match read_all().await {
             Ok(all) => {
                 if local_only() {
@@ -295,26 +317,32 @@ pub fn start(files: &Rc<Files>) {
 /// Store what commands wrote: OPFS paths into OPFS, download paths as downloads.
 pub fn flush(files: &Rc<Files>) {
     for (path, bytes) in vfs::take_writes() {
-        if let Some(name) = path.strip_prefix(OPFS) {
-            let name = name.to_string();
-            {
-                let mut e = files.entries.borrow_mut();
-                e.retain(|x| x.name != name);
-                if name != RECOVERY && name != RECOVERY_META {
-                    e.push(Entry { name: name.clone(), size: bytes.len() as u64, modified: js_sys::Date::now() });
-                    e.sort_by_key(|a| a.name.to_lowercase());
+        match disk::route(&path) {
+            disk::WriteTo::Opfs => {
+                let name = path.strip_prefix(OPFS).unwrap_or(&path).to_string();
+                {
+                    let mut e = files.entries.borrow_mut();
+                    e.retain(|x| x.name != name);
+                    if name != RECOVERY && name != RECOVERY_META {
+                        e.push(Entry { name: name.clone(), size: bytes.len() as u64, modified: js_sys::Date::now() });
+                        e.sort_by_key(|a| a.name.to_lowercase());
+                    }
                 }
+                let files = files.clone();
+                spawn_local(async move {
+                    if let Err(e) = write_file(&name, &bytes).await {
+                        files.say(format!("{name}: {e}"), true);
+                    }
+                });
             }
-            let files = files.clone();
-            spawn_local(async move {
-                if let Err(e) = write_file(&name, &bytes).await {
+            disk::WriteTo::Disk => disk::enqueue(files, &path, bytes),
+            disk::WriteTo::Download => {
+                let name = path.strip_prefix(DOWNLOADS).unwrap_or(&path);
+                if let Err(e) = download(name, &bytes) {
                     files.say(format!("{name}: {e}"), true);
                 }
-            });
-        } else if let Some(name) = path.strip_prefix(DOWNLOADS)
-            && let Err(e) = download(name, &bytes)
-        {
-            files.say(format!("{name}: {e}"), true);
+            }
+            disk::WriteTo::Memory => {}
         }
     }
 }
@@ -427,8 +455,15 @@ pub fn pick_from_disk(files: &Rc<Files>, intent: Intent) {
     let picker = Reflect::get(&window, &"showOpenFilePicker".into()).ok().and_then(|f| f.dyn_into::<Function>().ok());
     match picker {
         Some(f) => {
-            let opts = Object::new();
-            let _ = Reflect::set(&opts, &"multiple".into(), &JsValue::FALSE);
+            // A design from the computer's disk keeps its file, so Save writes back to it.
+            let on_disk = intent == Intent::Open && disk::supported();
+            let opts = if on_disk {
+                disk::open_options()
+            } else {
+                let opts = Object::new();
+                let _ = Reflect::set(&opts, &"multiple".into(), &JsValue::FALSE);
+                opts
+            };
             let promise = f.call1(&window, &opts);
             let files = files.clone();
             spawn_local(async move {
@@ -438,7 +473,13 @@ pub fn pick_from_disk(files: &Rc<Files>, intent: Intent) {
                     for h in handles.iter() {
                         let h: FileSystemFileHandle = h.dyn_into().map_err(|_| "not a file".to_string())?;
                         let bytes = read_handle(&h).await?;
-                        files.arrive(h.name(), bytes, intent);
+                        if on_disk && solidcraft_engine::io::is_design_path(&h.name()) {
+                            let path = disk::arrive(&h, bytes);
+                            files.opened.borrow_mut().push(path);
+                            files.wake();
+                        } else {
+                            files.arrive(h.name(), bytes, intent);
+                        }
                     }
                     Ok::<(), String>(())
                 };
@@ -458,7 +499,10 @@ fn input_picker(files: &Rc<Files>, intent: Intent) {
     let Some(doc) = web_sys::window().and_then(|w| w.document()) else { return };
     let Ok(input) = doc.create_element("input").map(|e| e.unchecked_into::<web_sys::HtmlInputElement>()) else { return };
     input.set_type("file");
-    input.set_accept(".solidcraft,.solvecraft,.json,.step,.stp,.3mf,.stl,.obj,.glb,.gltf");
+    // Everything the browser build imports, from the format registry: cadmpeg is pure Rust, so
+    // FreeCAD and Rhino files are part of it.
+    let accept = solidcraft_engine::io::formats::open_extensions(true).iter().map(|e| format!(".{e}")).collect::<Vec<_>>().join(",");
+    input.set_accept(&accept);
     // Attached (hidden) while it is open: some browsers ignore a click on a detached input.
     let _ = input.set_attribute("style", "display:none");
     if let Some(body) = doc.body() {

apps/solidcraft-web/src/linked.rs

@@ -0,0 +1,136 @@
+//! Bounded HTTPS downloads, handed to the normal design-open command as unsaved copies.
+use std::{cell::RefCell, rc::Rc};
+
+use js_sys::{Reflect, Uint8Array};
+use solidcraft_engine::io::vfs;
+use solidcraft_ui_egui::{SolveApp, ui_kit};
+use wasm_bindgen::{JsCast as _, JsValue};
+use wasm_bindgen_futures::{JsFuture, spawn_local};
+
+use crate::{check_download_size, design_url};
+
+type Reply = Result<(String, Vec<u8>), String>;
+
+#[derive(Default)]
+pub struct Download {
+    reply: Rc<RefCell<Option<Reply>>>,
+    pending: Option<(String, Vec<u8>)>,
+}
+
+impl Download {
+    pub fn start(url: Option<&str>, ctx: &egui::Context) -> Self {
+        let download = Self::default();
+        if let Some(url) = url {
+            let url = url.to_owned();
+            let slot = download.reply.clone();
+            let ctx = ctx.clone();
+            spawn_local(async move {
+                *slot.borrow_mut() = Some(fetch(&url).await);
+                ctx.request_repaint();
+            });
+        }
+        download
+    }
+
+    pub fn tick(&mut self, app: &mut SolveApp, ctx: &egui::Context) {
+        if let Some(reply) = self.reply.borrow_mut().take() {
+            match reply {
+                Ok(file) => self.pending = Some(file),
+                Err(error) => app.set_status(format!("Could not open design link: {error}"), true),
+            }
+        }
+        if self.pending.is_none() || app.file_picker_busy() {
+            return;
+        }
+        if solidcraft_ui_egui::documents::any_dirty(app) {
+            let mut answer = None;
+            let closed = ui_kit::Window::new(egui::Id::new("open_link"), "status_warning", solidcraft_ui_egui::i18n::tr("web.open_link"))
+                .required()
+                .show_body(ctx, |ui| {
+                    ui.label(solidcraft_ui_egui::i18n::tr("web.open_link_confirm"));
+                    ui.horizontal(|ui| {
+                        if ui_kit::button(ui, solidcraft_ui_egui::i18n::tr("ui.open"), ui_kit::Button::Normal).clicked() {
+                            answer = Some(true);
+                        }
+                        if ui_kit::button(ui, solidcraft_ui_egui::i18n::tr("ui.cancel"), ui_kit::Button::Normal).clicked() {
+                            answer = Some(false);
+                        }
+                    });
+                });
+            match answer {
+                Some(true) => {}
+                Some(false) => {
+                    self.pending = None;
+                    return;
+                }
+                None if closed => {
+                    self.pending = None;
+                    return;
+                }
+                None => return,
+            }
+        }
+        let Some((name, bytes)) = self.pending.take() else { return };
+        // The extension selects the design loader even when the URL has no extension.
+        let path = "/linked/design.solidcraft";
+        vfs::insert(path, bytes);
+        app.open_path(path);
+        if app.session.path.as_deref() == Some(path) {
+            app.session.path = None;
+            app.session.doc_mut().name = name;
+            app.session.mark_unsaved();
+        } else {
+            app.set_status("Could not open design link: the downloaded file is not a valid SolidCraft design", true);
+        }
+        let _ = vfs::remove(path);
+    }
+}
+
+async fn fetch(value: &str) -> Reply {
+    let url = design_url(value)?;
+    let name = url.path_segments().and_then(|mut segments| segments.next_back()).filter(|name| !name.is_empty()).unwrap_or("Design.solidcraft");
+    let decoded = js_sys::decode_uri_component(name).ok().and_then(|name| name.as_string()).unwrap_or_else(|| name.to_owned());
+    let name: String = decoded.strip_suffix(".solidcraft").unwrap_or(&decoded).chars().take(255).collect();
+    let window = web_sys::window().ok_or("No browser window")?;
+    let response = JsFuture::from(window.fetch_with_str(url.as_str())).await.map_err(|_| "Network request failed or the host refused CORS access")?;
+    let response: web_sys::Response = response.dyn_into().map_err(|_| "Invalid download response")?;
+    design_url(&response.url()).map_err(|_| "Design redirected to a URL that does not use HTTPS")?;
+    if !response.ok() {
+        return Err(format!("HTTP {} {}", response.status(), response.status_text()));
+    }
+    let length = response
+        .headers()
+        .get("Content-Length")
+        .map_err(|_| "Cannot read download size")?
+        .map(|value| value.parse::<u64>().map_err(|_| "Invalid Content-Length"))
+        .transpose()?;
+    if let Some(length) = length {
+        check_download_size(0, length)?;
+    }
+    let stream = response.body().ok_or("Download has no body")?;
+    let reader: web_sys::ReadableStreamDefaultReader = stream.get_reader().dyn_into().map_err(|_| "Cannot read download stream")?;
+    let result = read(&reader).await;
+    if result.is_err() {
+        let _ = JsFuture::from(reader.cancel()).await;
+    }
+    // Fetch rejects interrupted HTTP bodies and decodes Content-Encoding. Content-Length
+    // can describe compressed bytes, so the streamed limit also checks the decoded size.
+    let bytes = result?;
+    Ok((name, bytes))
+}
+
+async fn read(reader: &web_sys::ReadableStreamDefaultReader) -> Result<Vec<u8>, String> {
+    let mut bytes = Vec::new();
+    // Bound even a stream which keeps returning empty chunks.
+    for _ in 0..1_000_000 {
+        let chunk = JsFuture::from(reader.read()).await.map_err(|_| "Download interrupted")?;
+        if Reflect::get(&chunk, &JsValue::from_str("done")).map_err(|_| "Invalid download stream")?.as_bool() == Some(true) {
+            return Ok(bytes);
+        }
+        let value = Reflect::get(&chunk, &JsValue::from_str("value")).map_err(|_| "Invalid download chunk")?;
+        let chunk: Uint8Array = value.dyn_into().map_err(|_| "Invalid download bytes")?;
+        check_download_size(bytes.len(), u64::from(chunk.length()))?;
+        bytes.extend_from_slice(&chunk.to_vec());
+    }
+    Err("Download returned too many chunks".into())
+}

apps/solidcraft-web/src/main.rs

@@ -8,23 +8,91 @@
 
 #[cfg(target_arch = "wasm32")]
 mod api;
+#[cfg(any(target_arch = "wasm32", test))]
+mod disk;
 #[cfg(target_arch = "wasm32")]
 mod files;
 #[cfg(target_arch = "wasm32")]
 mod install;
+#[cfg(target_arch = "wasm32")]
+mod linked;
 #[cfg(any(target_arch = "wasm32", test))]
 mod space_mouse;
 
+/// The browser switches tabs with Ctrl+Tab and Ctrl+Shift+Tab, so the page leaves those keys to
+/// it (#5227); plain Tab and Shift+Tab still move between the app's fields. (Ctrl+PageUp and
+/// Ctrl+PageDown already reach the browser.)
+#[cfg(any(target_arch = "wasm32", test))]
+fn browser_switches_tabs(key: &str, ctrl: bool) -> bool {
+    ctrl && key == "Tab"
+}
+
+#[cfg(any(target_arch = "wasm32", test))]
+fn query_flag(query: &str, name: &str) -> bool {
+    url::form_urlencoded::parse(query.trim_start_matches('?').as_bytes()).any(|(key, _)| key == name)
+}
+
+/// Launch options use exact query keys; URL values are decoded only once.
+#[cfg(any(target_arch = "wasm32", test))]
+#[derive(Default, Debug)]
+struct Launch {
+    open: Option<String>,
+    embed: bool,
+}
+
+#[cfg(any(target_arch = "wasm32", test))]
+impl Launch {
+    fn parse(query: &str) -> Self {
+        let mut launch = Self::default();
+        let mut embed = false;
+        for (key, value) in url::form_urlencoded::parse(query.trim_start_matches('?').as_bytes()) {
+            match key.as_ref() {
+                "open" if launch.open.is_none() => launch.open = Some(value.into_owned()),
+                "embed" => embed = true,
+                _ => {}
+            }
+        }
+        launch.embed = embed && launch.open.is_some();
+        launch
+    }
+
+    fn persists(&self) -> bool {
+        !self.embed
+    }
+}
+
+#[cfg(any(target_arch = "wasm32", test))]
+fn design_url(value: &str) -> Result<url::Url, String> {
+    if value.len() > 16_384 {
+        return Err("Design URL is too long".into());
+    }
+    let url = url::Url::parse(value).map_err(|_| "Invalid design URL")?;
+    if url.scheme() != "https" || url.host_str().is_none() || !url.username().is_empty() || url.password().is_some() {
+        return Err("Design links must use HTTPS without credentials".into());
+    }
+    Ok(url)
+}
+
+#[cfg(any(target_arch = "wasm32", test))]
+fn check_download_size(current: usize, incoming: u64) -> Result<(), String> {
+    let cap = solidcraft_engine::io::MAX_DESIGN_BYTES as u64;
+    if current as u64 > cap || incoming > cap.saturating_sub(current as u64) {
+        return Err(format!("Design exceeds the {} MB size limit", cap / (1024 * 1024)));
+    }
+    Ok(())
+}
+
 #[cfg(target_arch = "wasm32")]
 mod web {
     use std::rc::Rc;
 
     use solidcraft_engine::Session;
     use solidcraft_engine::io::vfs;
-    use solidcraft_ui_egui::{Services, SolveApp};
+    use solidcraft_ui_egui::{Services, SolveApp, ui_kit};
     use wasm_bindgen::JsCast as _;
 
     use crate::api::Api;
+    use crate::disk::{self, SaveTarget};
     use crate::files::{self, Files, Intent};
     use crate::space_mouse::SpaceMouse;
 
@@ -81,12 +149,29 @@ mod web {
         on_unload.forget();
     }
 
+    /// eframe cancels the browser's action for every Tab it gets, so the browser couldn't switch
+    /// tabs while the app has the keyboard. Its tab-switching keys stop here, on the way down to
+    /// the canvas, before eframe sees them; the browser then acts on them as usual.
+    fn leave_tab_switching_to_browser(window: &web_sys::Window) {
+        let on_key = wasm_bindgen::closure::Closure::<dyn FnMut(web_sys::KeyboardEvent)>::new(|e: web_sys::KeyboardEvent| {
+            if crate::browser_switches_tabs(&e.key(), e.ctrl_key()) {
+                e.stop_propagation();
+            }
+        });
+        let _ = window.add_event_listener_with_callback_and_bool("keydown", on_key.as_ref().unchecked_ref(), true);
+        // The listener lives as long as the page.
+        on_key.forget();
+    }
+
     const JAPANESE_FONT_PATH: &str = "./fonts/BIZUDPGothic-Regular.ttf";
 
     type FontLoadResult = Rc<std::cell::RefCell<Option<Result<Vec<u8>, String>>>>;
 
     struct Shell {
         app: SolveApp,
+        launch: crate::Launch,
+        linked: crate::linked::Download,
+        full_url: Option<String>,
         api: Api,
         files: Rc<Files>,
         /// When the last autosave was (seconds), and the revision it holds (none stored: `None`).
@@ -101,12 +186,20 @@ mod web {
         /// On-demand CJK font: fetched only when a CJK language is selected.
         font: solidcraft_ui_egui::fonts::CjkFontLoader,
         font_result: FontLoadResult,
+        /// The fetched CJK font's bytes: kept so a language change can re-order the fallbacks.
+        cjk_bytes: Option<Vec<u8>>,
+        /// The language the fonts were last set up for (a CJK UI leads with the CJK face).
+        font_language: String,
         space_mouse: SpaceMouse,
+        wheel_gestures: solidcraft_ui_egui::WebWheelGestures,
     }
 
     impl Shell {
         /// Files from the computer, writes to store, messages and the autosave.
         fn files_tick(&mut self, ctx: &egui::Context) {
+            if !self.launch.persists() {
+                return;
+            }
             if self.files.ctx.borrow().is_none() {
                 *self.files.ctx.borrow_mut() = Some(ctx.clone());
             }
@@ -117,6 +210,23 @@ mod web {
                 return;
             }
             files::flush(&self.files);
+            // A write to the computer's disk that failed: the design is not saved after all.
+            for path in self.files.unsaved.borrow_mut().drain(..) {
+                if self.app.session.path.as_deref() == Some(path.as_str()) {
+                    self.app.session.mark_unsaved();
+                }
+            }
+            // Designs opened from the computer's disk (the files window): open them.
+            let opened: Vec<_> = self.files.opened.borrow_mut().drain(..).collect();
+            for path in opened {
+                self.app.open_path(&path);
+                self.files.panel.set(false);
+            }
+            // Recent designs whose file is gone are dropped from the list.
+            for path in self.files.gone.borrow_mut().drain(..) {
+                self.app.home.recent.retain(|r| *r != path);
+                self.app.home.opened_at.remove(&path);
+            }
             for (text, error) in self.files.messages.borrow_mut().drain(..) {
                 self.app.set_status(text, error);
             }
@@ -183,15 +293,27 @@ mod web {
         fn sync_recents(&mut self) {
             let mut entries = self.files.entries.borrow().clone();
             entries.sort_by(|a, b| b.modified.total_cmp(&a.modified));
+            let forgotten = self.app.home.forgotten.clone();
             let recent = &mut self.app.home.recent;
-            recent.retain(|p| vfs::exists(p));
+            let known = self.files.disk_known.borrow().clone();
+            // A design on the computer's disk stays listed while its file is remembered.
+            recent.retain(|p| vfs::exists(p) || disk::parse(p).is_some_and(|(id, _)| known.contains(id)));
             for e in entries.iter().filter(|e| solidcraft_engine::io::is_design_path(&e.name)) {
                 let p = format!("{}{}", files::OPFS, e.name);
-                if !recent.contains(&p) {
+                // A design the user removed from the list is not added back while it is stored.
+                if !recent.contains(&p) && !forgotten.contains(&p) {
                     recent.push(p);
                 }
             }
             recent.truncate(solidcraft_ui_egui::home::MAX_RECENT);
+            // Remembered files that no recent design or autosave names are forgotten in time.
+            let recovered = self.files.recovery.borrow().as_ref().and_then(|(_, p)| p.clone());
+            let keep = recent.iter().chain(recovered.as_ref()).filter_map(|p| disk::parse(p)).map(|(id, _)| id.to_string()).collect();
+            disk::prune(keep);
+            // Drop forgotten entries whose stored design is gone, so the set does not grow without bound.
+            let stored: std::collections::BTreeSet<String> =
+                entries.iter().filter(|e| solidcraft_engine::io::is_design_path(&e.name)).map(|e| format!("{}{}", files::OPFS, e.name)).collect();
+            self.app.home.forgotten.retain(|p| stored.contains(p));
         }
 
         /// The stored designs: open, insert, rename, delete, download; open from the computer.
@@ -199,27 +321,27 @@ mod web {
             if !self.files.panel.get() {
                 return;
             }
-            let mut open = true;
             let mut act: Option<(&'static str, String)> = None;
-            egui::Window::new("Files in this browser")
-                .open(&mut open)
-                .collapsible(false)
-                .resizable(true)
-                .default_width(520.0)
-                .pivot(egui::Align2::CENTER_CENTER)
-                .default_pos(ctx.content_rect().center())
-                .show(ctx, |ui| {
+            let closed = solidcraft_ui_egui::ui_kit::Window::new(egui::Id::new("sc_browser_files"), "folder", "Files in this browser")
+                .cards(3.0)
+                .show_body(ctx, |ui| {
                     ui.horizontal(|ui| {
-                        if ui.button("Open from computer…").clicked() {
+                        if ui_kit::button(ui, "Open from computer…", ui_kit::Button::Normal).clicked() {
                             files::pick_from_disk(&self.files, Intent::Open);
                         }
-                        if ui.button("Insert from computer…").on_hover_text("STEP, 3MF or STL into the open design").clicked() {
+                        if ui_kit::button(ui, "Insert from computer…", ui_kit::Button::Normal)
+                            .on_hover_text("STEP, 3MF or STL into the open design")
+                            .clicked()
+                        {
                             files::pick_from_disk(&self.files, Intent::Insert);
                         }
-                        if ui.button("Download open design").clicked() {
+                        if ui_kit::button(ui, "Download open design", ui_kit::Button::Normal).clicked() {
                             act = Some(("download_open", String::new()));
                         }
                     });
+                    if !disk::supported() {
+                        ui.weak("This browser can't save to a folder: designs stay in this browser. Download design saves a file.");
+                    }
                     ui.separator();
                     if !self.files.ready.get() {
                         ui.horizontal(|ui| {
@@ -237,7 +359,7 @@ mod web {
                             for e in &entries {
                                 match &mut self.renaming {
                                     Some((from, to)) if *from == e.name => {
-                                        let r = ui.add(egui::TextEdit::singleline(to).desired_width(200.0));
+                                        let r = ui_kit::cell_editor(ui, ui.make_persistent_id(("stored_file_name", from.as_str())), to, "", false);
                                         if std::mem::take(&mut self.rename_focus) {
                                             r.request_focus();
                                         }
@@ -255,21 +377,31 @@ mod web {
                                 }
                                 ui.label(format!("{:.1} KB", e.size as f64 / 1024.0));
                                 ui.horizontal(|ui| {
-                                    if ui.small_button("Open").clicked() {
+                                    if ui_kit::button(ui, "Open", ui_kit::Button::Small).clicked() {
                                         act = Some(("open", e.name.clone()));
                                     }
                                     let design = solidcraft_engine::io::is_design_path(&e.name);
-                                    if !design && ui.small_button("Insert").on_hover_text("Into the open design (STEP, 3MF, STL)").clicked() {
+                                    if !design
+                                        && ui_kit::button(ui, "Insert", ui_kit::Button::Small)
+                                            .on_hover_text("Into the open design (STEP, 3MF, STL)")
+                                            .clicked()
+                                    {
                                         act = Some(("insert", e.name.clone()));
                                     }
-                                    if ui.small_button("Rename").clicked() {
+                                    if ui_kit::button(ui, "Rename", ui_kit::Button::Small).clicked() {
                                         self.renaming = Some((e.name.clone(), e.name.clone()));
                                         self.rename_focus = true;
                                     }
-                                    if ui.small_button("Download").clicked() {
+                                    if ui_kit::button(ui, "Save to computer…", ui_kit::Button::Small)
+                                        .on_hover_text("A copy in a file you choose; the stored design stays here")
+                                        .clicked()
+                                    {
+                                        act = Some(("save_copy", e.name.clone()));
+                                    }
+                                    if ui_kit::button(ui, "Download", ui_kit::Button::Small).clicked() {
                                         act = Some(("download", e.name.clone()));
                                     }
-                                    if ui.small_button("Delete").clicked() {
+                                    if ui_kit::button(ui, "Delete", ui_kit::Button::Small).clicked() {
                                         act = Some(("delete", e.name.clone()));
                                     }
                                 });
@@ -278,7 +410,7 @@ mod web {
                         });
                     });
                 });
-            if !open {
+            if closed {
                 self.files.panel.set(false);
                 self.renaming = None;
             }
@@ -301,6 +433,10 @@ mod web {
                     }
                     Err(e) => self.app.set_status(e.to_string(), true),
                 },
+                "save_copy" => match vfs::read(&path, solidcraft_engine::io::MAX_DESIGN_BYTES) {
+                    Ok(b) => disk::save_copy(&self.files, &name, b),
+                    Err(e) => self.app.set_status(e.to_string(), true),
+                },
                 "download_open" => {
                     let d = &self.app.session.doc;
                     let result = self
@@ -316,6 +452,8 @@ mod web {
                 "delete" => {
                     files::delete(&self.files, &name);
                     self.app.home.recent.retain(|r| *r != path);
+                    // The file is gone, so there is nothing left to keep forgotten.
+                    self.app.home.forgotten.remove(&path);
                 }
                 "rename_cancel" => self.renaming = None,
                 "rename" => {
@@ -329,6 +467,10 @@ mod web {
                                         *r = new.clone();
                                     }
                                 }
+                                // A forgotten design follows its new name.
+                                if self.app.home.forgotten.remove(&old) {
+                                    self.app.home.forgotten.insert(new);
+                                }
                             }
                             Err(e) => self.app.set_status(e, true),
                         }
@@ -342,20 +484,19 @@ mod web {
         fn recovery_prompt(&mut self, ctx: &egui::Context) {
             let Some((name, path)) = self.files.recovery.borrow().clone() else { return };
             let mut answer = None;
-            egui::Window::new("Recover unsaved work?").collapsible(false).resizable(false).anchor(egui::Align2::CENTER_CENTER, [0.0, 0.0]).show(
-                ctx,
-                |ui| {
+            let _ = solidcraft_ui_egui::ui_kit::Window::new(egui::Id::new("sc_browser_recovery"), "restore", "Recover unsaved work?")
+                .required()
+                .show_body(ctx, |ui| {
                     ui.label(format!("“{name}” had unsaved changes when this page last closed."));
                     ui.horizontal(|ui| {
-                        if ui.button("Recover").clicked() {
+                        if ui_kit::button(ui, "Recover", ui_kit::Button::Normal).clicked() {
                             answer = Some(true);
                         }
-                        if ui.button("Discard").clicked() {
+                        if ui_kit::button(ui, "Discard", ui_kit::Button::Normal).clicked() {
                             answer = Some(false);
                         }
                     });
-                },
-            );
+                });
             let Some(recover) = answer else { return };
             *self.files.recovery.borrow_mut() = None;
             if recover {
@@ -375,7 +516,10 @@ mod web {
             let done = self.font_result.borrow_mut().take();
             if let Some(res) = done {
                 let installed = match res {
-                    Ok(bytes) => solidcraft_ui_egui::fonts::install_cjk_font(ctx, bytes),
+                    Ok(bytes) => {
+                        self.cjk_bytes = Some(bytes);
+                        true
+                    }
                     Err(err) => {
                         log::warn!("failed to fetch CJK font from {JAPANESE_FONT_PATH}: {err}");
                         false
@@ -387,11 +531,29 @@ mod web {
                     log::warn!("CJK font unavailable; showing English for this session");
                 }
                 self.font.finished(installed, &mut self.app.preferences.language);
+                self.apply_fonts(ctx);
                 ctx.request_repaint();
             }
             if self.font.tick(&mut self.app.preferences.language) {
                 self.fetch_font(ctx);
             }
+            // The CJK face leads only a CJK UI: its Cyrillic glyphs are full-width, so switching
+            // to Ukrainian (or English) must put the Latin face back in front.
+            if self.app.preferences.language != self.font_language {
+                self.apply_fonts(ctx);
+            }
+        }
+
+        /// Set up the UI fonts for the live language, keeping the fetched CJK font as a fallback
+        /// (it leads only for a CJK UI, see [`solidcraft_ui_egui::fonts::install_cjk_font_for`]).
+        fn apply_fonts(&mut self, ctx: &egui::Context) {
+            match self.cjk_bytes.clone() {
+                Some(bytes) => {
+                    solidcraft_ui_egui::fonts::install_cjk_font_for(ctx, bytes, &self.app.preferences.language);
+                }
+                None => solidcraft_ui_egui::fonts::setup_fonts(ctx),
+            }
+            self.font_language.clone_from(&self.app.preferences.language);
         }
 
         /// CJK text on screen with no CJK font yet (an English UI showing a Japanese name):
@@ -423,19 +585,46 @@ mod web {
             UNSAVED.with(|u| u.set(solidcraft_ui_egui::documents::any_dirty(&self.app)));
         }
         fn raw_input_hook(&mut self, ctx: &egui::Context, raw: &mut egui::RawInput) {
-            files::take_drops(&self.files, raw);
+            let now = raw.time.unwrap_or_else(|| ctx.input(|i| i.time));
+            if let Some(delay) = self.wheel_gestures.update(raw, now) {
+                ctx.request_repaint_after(delay);
+            }
+            if self.launch.persists() {
+                files::take_drops(&self.files, raw);
+            } else {
+                raw.dropped_files.clear();
+            }
             // Before the app's own hook, which adds the control channel's events.
             self.space_mouse.raw_input_hook(ctx, self.app.preferences.space_mouse_enabled, raw);
             self.app.raw_input_hook(raw);
         }
         fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
+            self.linked.tick(&mut self.app, ui.ctx());
+            UNSAVED.with(|u| u.set(self.launch.persists() && solidcraft_ui_egui::documents::any_dirty(&self.app)));
+            if self.launch.embed {
+                ui_kit::Container::new(ui.ctx(), ui_kit::Surface::Chrome).edge("embed_header", ui_kit::Edge::Top).show(ui, |ui| {
+                    if ui_kit::button(ui, solidcraft_ui_egui::i18n::tr("web.open_full"), ui_kit::Button::Normal).clicked()
+                        && let (Some(window), Some(url)) = (web_sys::window(), &self.full_url)
+                    {
+                        let _ = window.open_with_url_and_target_and_features(url, "_blank", "noopener");
+                    }
+                });
+            }
             self.app.ui(ui);
             let ctx = ui.ctx().clone();
-            self.file_panel(&ctx);
-            self.recovery_prompt(&ctx);
+            if self.launch.persists() {
+                self.file_panel(&ctx);
+                self.recovery_prompt(&ctx);
+            }
             self.watch_text_for_font(&ctx);
         }
+        fn persist_egui_memory(&self) -> bool {
+            self.launch.persists()
+        }
         fn save(&mut self, storage: &mut dyn eframe::Storage) {
+            if !self.launch.persists() {
+                return;
+            }
             // Persist the user's own language, not a session-only English fallback.
             let saved = self.font.persisted_language(&self.app.preferences.language).to_owned();
             let live = std::mem::replace(&mut self.app.preferences.language, saved);
@@ -454,15 +643,15 @@ mod web {
 
     /// Render with WebGL2: asked for now (`?webgl`, remembered) or before (until `?webgpu`).
     fn webgl() -> bool {
-        let storage = web_sys::window().and_then(|w| w.local_storage().ok().flatten());
+        let storage = crate::Launch::parse(&query()).persists().then(|| web_sys::window().and_then(|w| w.local_storage().ok().flatten())).flatten();
         let q = query();
-        if q.contains("webgl") {
+        if crate::query_flag(&q, "webgl") {
             if let Some(s) = &storage {
                 let _ = s.set_item(WEBGL_KEY, "1");
             }
             return true;
         }
-        if q.contains("webgpu") {
+        if crate::query_flag(&q, "webgpu") {
             if let Some(s) = &storage {
                 let _ = s.remove_item(WEBGL_KEY);
             }
@@ -488,7 +677,11 @@ mod web {
         eframe::WebLogger::init(log::LevelFilter::Info).ok();
         wasm_bindgen_futures::spawn_local(async {
             let Some(window) = web_sys::window() else { return };
-            ask_before_unload(&window);
+            let launch = crate::Launch::parse(&query());
+            if launch.persists() {
+                ask_before_unload(&window);
+            }
+            leave_tab_switching_to_browser(&window);
             let Some(document) = window.document() else { return };
             let Some(canvas) = document.get_element_by_id(CANVAS_ID).and_then(|e| e.dyn_into::<web_sys::HtmlCanvasElement>().ok()) else {
                 log::error!("missing <canvas id=\"{CANVAS_ID}\">");
@@ -507,41 +700,66 @@ mod web {
                     Box::new(move |cc| {
                         solidcraft_ui_egui::fonts::setup_fonts(&cc.egui_ctx);
                         let files = Rc::new(Files::default());
-                        files::start(&files);
-                        let panel = files.clone();
-                        let services = Services {
-                            // Open shows the browser's files (and the computer's, from there).
-                            pick_open: Some(Box::new(move |_: &[&str]| {
+                        if launch.persists() {
+                            files::start(&files);
+                        }
+                        let (panel, opener, saver, shown) = (files.clone(), files.clone(), files.clone(), files.clone());
+                        let (restorable, restorer) = (files.clone(), files.clone());
+                        let services = if launch.embed { Services::default() } else { Services {
+                            // Open shows the browser's open dialog for a design where it has one
+                            // (the file keeps its handle, so Save writes back to it); otherwise,
+                            // and for inserting STEP or meshes, the browser's files window.
+                            pick_open: Some(Box::new(move |exts: &[&str]| {
+                                if disk::handles_open(exts) {
+                                    return Box::pin(disk::pick_open(&opener));
+                                }
                                 panel.panel.set(true);
                                 Box::pin(std::future::ready(None))
                             })),
-                            // Designs are kept in the browser; everything else is downloaded.
-                            pick_save: Some(Box::new(|name: &str, exts: &[&str]| {
+                            // A design is saved to a file the user picks, or kept in the browser
+                            // where the browser can't pick one; everything else is downloaded.
+                            pick_save: Some(Box::new(move |name: &str, exts: &[&str]| {
                                 let design = exts.contains(&solidcraft_engine::io::DESIGN_EXT);
-                                Box::pin(std::future::ready(Some(format!("{}{name}", if design { files::OPFS } else { files::DOWNLOADS }))))
+                                match disk::save_target(disk::supported(), design) {
+                                    SaveTarget::Disk => Box::pin(disk::pick_save(&saver, name)),
+                                    SaveTarget::Browser => {
+                                        saver.say("This browser can't save to a folder: the design is kept in this browser. File > Download design saves a file.", false);
+                                        Box::pin(std::future::ready(Some(format!("{}{name}", files::OPFS))))
+                                    }
+                                    SaveTarget::Download => Box::pin(std::future::ready(Some(format!("{}{name}", files::DOWNLOADS)))),
+                                }
                             })),
+                            // A recent design on the disk, from an earlier session, opens by asking
+                            // the browser for its remembered file.
+                            can_restore: Some(Box::new(move |path: &str| {
+                                disk::parse(path).is_some_and(|(id, _)| restorable.disk_known.borrow().contains(id))
+                            })),
+                            restore_file: Some(Box::new(move |path: &str| disk::restore(&restorer, path))),
+                            download_design: Some(Box::new(files::download)),
+                            browser_files: Some(Box::new(move || shown.panel.set(true))),
                             install_app: Some(crate::install::service(&cc.egui_ctx)),
                             ..Default::default()
-                        };
+                        }};
                         // Thumbnails of saves and start-page cards.
                         solidcraft_ui_egui::gpu::install_cpu_picture_renderer();
                         let (sender, receiver) = std::sync::mpsc::channel();
                         let mut app = SolveApp::new(Session::default(), services).with_control(receiver);
-                        if let Some(p) = cc.storage.and_then(|s| solidcraft_ui_egui::prefs::stored(|k| s.get_string(k))) {
+                        app.embedded = launch.embed;
+                        if launch.persists() && let Some(p) = cc.storage.and_then(|s| solidcraft_ui_egui::prefs::stored(|k| s.get_string(k))) {
                             app.load_prefs(&p);
                         }
                         if let Some(rs) = &cc.wgpu_render_state {
                             // eframe's web painter has no stencil buffer.
                             app.set_wgpu(rs, DEPTH_BITS, 0, 1);
                         }
-                        if query().contains("sample") {
+                        if launch.open.is_none() && crate::query_flag(&query(), "sample") {
                             if let Err(e) = app.session.run_script(&solidcraft_engine::sample::script()) {
                                 app.set_status(format!("sample: {e}"), true);
                             }
                             app.session.doc_mut().name = "Sample Plate".into();
                             app.session.mark_saved();
                         }
-                        if !query().contains("sample") {
+                        if launch.open.is_none() && !crate::query_flag(&query(), "sample") {
                             // The empty design takes Units of new designs (#1205). The sample
                             // part is built in millimetres and is left that way.
                             solidcraft_ui_egui::prefs::apply_new_design(&mut app);
@@ -549,8 +767,21 @@ mod web {
                             app.home.show(rev);
                         }
                         let api = Api::install(sender, cc.egui_ctx.clone()).map_err(|e| format!("SolidCraft browser API: {e:?}"))?;
+                        let font_language = app.preferences.language.clone();
+                        let linked = crate::linked::Download::start(launch.open.as_deref(), &cc.egui_ctx);
+                        let full_url = window.location().href().ok().and_then(|value| url::Url::parse(&value).ok()).map(|mut url| {
+                            url.set_query(None);
+                            url.set_fragment(None);
+                            if let Some(open) = &launch.open {
+                                url.query_pairs_mut().append_pair("open", open);
+                            }
+                            url.to_string()
+                        });
                         Ok(Box::new(Shell {
                             app,
+                            launch,
+                            linked,
+                            full_url,
                             api,
                             files,
                             autosaved_at: f64::NEG_INFINITY,
@@ -560,7 +791,10 @@ mod web {
                             recents_synced: false,
                             font: Default::default(),
                             font_result: Rc::new(std::cell::RefCell::new(None)),
+                            cjk_bytes: None,
+                            font_language,
                             space_mouse: SpaceMouse::default(),
+                            wheel_gestures: solidcraft_ui_egui::WebWheelGestures::default(),
                         }))
                     }),
                 )
@@ -586,3 +820,59 @@ fn main() {
 fn main() {
     eprintln!("solidcraft-web only runs in the browser: build it with `trunk build --release` in apps/solidcraft-web");
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn link_query_decodes_once_and_embed_disables_persistence() {
+        assert!(!query_flag("?open=https://example.org/webgl?sample", "webgl"));
+        assert!(!query_flag("?open=https://example.org/webgl?sample", "sample"));
+        assert!(query_flag("?embed&webgl", "webgl"));
+        let launch = Launch::parse("?embed&open=https%3A%2F%2Fexample.org%2Farm.solidcraft%3Fx%3Da%2520b%26y%3D1");
+        assert_eq!(launch.open.as_deref(), Some("https://example.org/arm.solidcraft?x=a%20b&y=1"));
+        assert!(launch.embed);
+        assert!(!launch.persists());
+        assert!(!Launch::parse("?embed").embed);
+        assert!(!Launch::parse("?other=embed&reopen=https://example.org").embed);
+        assert!(Launch::parse("?open=https://example.org/a").persists());
+        assert_eq!(Launch::parse("?open=first&open=second").open.as_deref(), Some("first"));
+    }
+
+    #[test]
+    fn design_links_refuse_hostile_schemes_credentials_and_sizes() {
+        assert!(design_url("https://example.org/arm.solidcraft?download=1").is_ok());
+        for value in [
+            "http://example.org/a",
+            "data:application/json,{}",
+            "blob:https://example.org/a",
+            "javascript:alert(1)",
+            "/arm.solidcraft",
+            "https://user:secret@example.org/a",
+            "",
+        ] {
+            assert!(design_url(value).is_err(), "{value}");
+        }
+        assert!(design_url(&format!("https://example.org/{}", "x".repeat(16_384))).is_err());
+        assert!(design_url("http://redirect.example.org/a").is_err());
+
+        let cap = solidcraft_engine::io::MAX_DESIGN_BYTES;
+        assert!(check_download_size(0, cap as u64).is_ok());
+        assert!(check_download_size(0, cap as u64 + 1).is_err());
+        assert!(check_download_size(cap - 2, 2).is_ok());
+        assert!(check_download_size(cap - 2, 3).is_err());
+        assert!(check_download_size(0, u64::MAX).is_err());
+        assert!(check_download_size(cap, 1).is_err());
+        assert!(check_download_size(usize::MAX, 0).is_err());
+    }
+
+    #[test]
+    fn only_ctrl_tab_is_left_to_the_browser() {
+        // Ctrl+Tab and Ctrl+Shift+Tab (the event's key is "Tab" either way) switch browser tabs.
+        assert!(browser_switches_tabs("Tab", true));
+        // Tab and Shift+Tab move between the app's fields; Ctrl with other keys stays the app's.
+        assert!(!browser_switches_tabs("Tab", false));
+        assert!(!browser_switches_tabs("s", true));
+    }
+}

apps/solidcraft-web/src/space_mouse.rs

@@ -7,7 +7,7 @@
 //! navigation takes them with 3DxWare's object-mode mapping, as the Linux app does without a
 //! profile.
 
-use solidcraft_ui_egui::space_mouse::{Axes, FULL_SCALE};
+use solidcraft_ui_egui::space_mouse::{Axes, Calibration, FULL_SCALE, calibrated};
 
 /// Logitech's vendor id, which older 3Dconnexion devices carry, and those devices' product ids
 /// (usb.ids). Logitech's own gamepads and wheels carry the same vendor id.
@@ -60,9 +60,43 @@ pub fn axes(values: &[f64]) -> Option<Axes> {
     Some(Axes { translation: [raw(0)?, raw(1)?, raw(2)?], rotation: [raw(3)?, raw(4)?, raw(5)?] })
 }
 
+/// What a calibration of the gamepad with this id is saved under: `web` and its vendor and
+/// product ids.
+pub fn device_key(id: &str) -> Option<String> {
+    vendor_product(id).map(|(vendor, product)| format!("web {vendor:04x}:{product:04x}"))
+}
+
 /// The 3D mouse to read among the ones listed: the first device, else the first joystick.
-pub fn choose(found: impl IntoIterator<Item = (Source, Axes)>) -> Option<Axes> {
-    found.into_iter().min_by_key(|(source, _)| *source).map(|(_, axes)| axes)
+pub fn choose<T>(found: impl IntoIterator<Item = (Source, T)>) -> Option<T> {
+    found.into_iter().min_by_key(|(source, _)| *source).map(|(_, reading)| reading)
+}
+
+/// Whether the cap is moving as the next frame will see it: through the device's calibration
+/// (as of the last frame) when it has one. The idle page wakes for a short-range device's push,
+/// and not for a device resting off zero; the wheel filter goes by the same.
+pub fn moving(axes: Axes, calibration: Option<Calibration>) -> bool {
+    calibrated(axes, calibration).moving()
+}
+
+/// The calibration as of the last frame, and the device it was for.
+pub type Cached = (Option<String>, Option<Calibration>);
+
+/// Whether the cap of `device` is moving, judged with the calibration kept from the last frame:
+/// `None` when that was for another device, so another's calibration never judges this one. The
+/// waker then lets a frame look, which brings the cache up to date.
+pub fn moving_as_cached(device: &Option<String>, axes: Axes, cached: &Cached) -> Option<bool> {
+    (*device == cached.0).then(|| moving(axes, cached.1))
+}
+
+/// Whether the idle page's timer redraws: when the cap is moving as the last frame's calibration
+/// judges it, when the device read isn't the one that calibration was for (a frame then judges
+/// it with its own), and once when the device the last frame read is gone, so the page shows
+/// that. With no device, and none last frame, it stays quiet.
+pub fn wakes(reading: Option<(Option<String>, Axes)>, cached: &Cached) -> bool {
+    match reading {
+        Some((device, axes)) => moving_as_cached(&device, axes, cached).unwrap_or(true),
+        None => cached.0.is_some(),
+    }
 }
 
 #[cfg(target_arch = "wasm32")]
@@ -70,29 +104,29 @@ pub use browser::SpaceMouse;
 
 #[cfg(target_arch = "wasm32")]
 mod browser {
-    use std::cell::Cell;
+    use std::cell::{Cell, RefCell};
     use std::rc::Rc;
 
     use solidcraft_ui_egui::SolveApp;
-    use solidcraft_ui_egui::space_mouse::{Axes, DriverMapping, navigate_frame};
+    use solidcraft_ui_egui::space_mouse::{Axes, DriverMapping, calibration, navigate_frame};
     use wasm_bindgen::JsCast as _;
     use wasm_bindgen::closure::Closure;
 
     use solidcraft_ui_egui::space_mouse::WheelGuard;
 
-    use super::{axes, choose, source};
+    use super::{Cached, axes, choose, device_key, moving_as_cached, source, wakes};
 
     /// How often the page looks for the cap starting to move while nothing else redraws.
     const WAKE_MS: i32 = 50;
 
-    /// The 3D mouse the browser lists, if any.
-    fn read() -> Option<Axes> {
+    /// The 3D mouse the browser lists, if any: its calibration key and its axes.
+    fn read() -> Option<(Option<String>, Axes)> {
         let pads = web_sys::window()?.navigator().get_gamepads().ok()?;
         choose(pads.iter().filter_map(|pad| {
             let pad = pad.dyn_into::<web_sys::Gamepad>().ok().filter(web_sys::Gamepad::connected)?;
             let source = source(&pad.id())?;
             let values: Vec<f64> = pad.axes().iter().map(|v| v.as_f64().unwrap_or(f64::NAN)).collect();
-            Some((source, axes(&values)?))
+            Some((source, (device_key(&pad.id()), axes(&values)?)))
         }))
     }
 
@@ -100,6 +134,8 @@ mod browser {
     #[derive(Default)]
     pub struct SpaceMouse {
         axes: Axes,
+        /// The 3D mouse being read, as `SolveApp::space_mouse` keeps it.
+        device: Option<String>,
         /// The previous frame's time and the step since it (seconds).
         last: Option<f64>,
         seconds: f64,
@@ -111,6 +147,8 @@ mod browser {
         waking: bool,
         /// Navigation is on (the waker reads it).
         enabled: Rc<Cell<bool>>,
+        /// The calibration as of the last frame and its device (the waker and the wheel filter read it).
+        cached: Rc<RefCell<Cached>>,
     }
 
     impl SpaceMouse {
@@ -131,14 +169,18 @@ mod browser {
             }
             let reading = read();
             if reading.is_some() && !self.waking {
-                self.waking = wake(ctx, &self.enabled);
+                self.waking = wake(ctx, &self.enabled, &self.cached);
             }
-            // Inside the dead zone is rest: a cap resting just off zero doesn't keep redrawing.
-            self.axes = reading.filter(|axes| axes.moving()).unwrap_or_default();
-            self.wheel.filter(self.axes.moving(), now, &mut raw.events);
+            // As read: calibration needs the readings at rest too, and `navigate_frame` leaves a
+            // cap resting inside the dead zone alone.
+            (self.device, self.axes) = reading.unwrap_or_default();
+            let moving = moving_as_cached(&self.device, self.axes, &self.cached.borrow()).unwrap_or_else(|| self.axes.moving());
+            self.wheel.filter(moving, now, &mut raw.events);
         }
 
         pub fn logic(&self, app: &mut SolveApp, ctx: &egui::Context) {
+            app.space_mouse.device.clone_from(&self.device);
+            *self.cached.borrow_mut() = (self.device.clone(), calibration(app));
             navigate_frame(app, ctx, DriverMapping::object_mode(), self.axes, self.seconds);
         }
     }
@@ -156,11 +198,11 @@ mod browser {
 
     /// The browser sends no event when a gamepad moves, so a timer looks while the app is idle and
     /// redraws when the cap starts moving; the frames that follow keep going on their own.
-    fn wake(ctx: &egui::Context, enabled: &Rc<Cell<bool>>) -> bool {
+    fn wake(ctx: &egui::Context, enabled: &Rc<Cell<bool>>, cached: &Rc<RefCell<Cached>>) -> bool {
         let Some(window) = web_sys::window() else { return false };
-        let (ctx, enabled) = (ctx.clone(), Rc::clone(enabled));
+        let (ctx, enabled, cached) = (ctx.clone(), Rc::clone(enabled), Rc::clone(cached));
         let tick = Closure::<dyn FnMut()>::new(move || {
-            if enabled.get() && read().is_some_and(Axes::moving) {
+            if enabled.get() && wakes(read(), &cached.borrow()) {
                 ctx.request_repaint();
             }
         });
@@ -192,6 +234,46 @@ mod tests {
         }
     }
 
+    #[test]
+    fn a_calibration_is_saved_under_the_ids_whichever_browser_lists_it() {
+        assert_eq!(device_key("SpaceMouse Pro (Vendor: 046d Product: c62b)").as_deref(), Some("web 046d:c62b"));
+        assert_eq!(device_key("46d-c62b-SpaceMouse Pro").as_deref(), Some("web 046d:c62b"));
+        assert_eq!(device_key("Xbox Wireless Controller"), None);
+    }
+
+    #[test]
+    fn the_idle_page_wakes_for_motion_as_calibrated_not_as_read() {
+        let axis =
+            |source, rest, full| solidcraft_ui_egui::space_mouse::AxisCalibration { source, reversed: false, rest, dead_zone: 0, full: [full; 2] };
+        // A short-range device: 15 of its 50 is under the raw dead zone, but 105 of 350 calibrated.
+        let short = Calibration { dead_zone_share: 0.0, kind: Default::default(), axes: std::array::from_fn(|r| axis(r, 0, 50)) };
+        let push = Axes { translation: [15, 0, 0], rotation: [0; 3] };
+        assert!(!push.moving() && moving(push, Some(short)));
+        // A device resting at 100 on every axis: past the raw dead zone, but at rest calibrated.
+        let offset = Calibration { dead_zone_share: 0.0, kind: Default::default(), axes: std::array::from_fn(|r| axis(r, 100, 350)) };
+        let resting = Axes { translation: [100; 3], rotation: [100; 3] };
+        assert!(resting.moving() && !moving(resting, Some(offset)));
+        // Without a calibration, as read.
+        assert!(!moving(push, None) && moving(resting, None));
+        // Kept from the last frame: only for the device it was for.
+        let (a, b) = (Some("web 256f:c63a".to_string()), Some("web 1234:5678".to_string()));
+        assert_eq!(moving_as_cached(&b, push, &(b.clone(), Some(short))), Some(true));
+        assert_eq!(moving_as_cached(&b, push, &(a.clone(), Some(offset))), None, "A's calibration doesn't judge B");
+        assert_eq!(moving_as_cached(&b, push, &(None, None)), None);
+        assert_eq!(moving_as_cached(&a, resting, &(a.clone(), None)), Some(true), "A was read without a calibration");
+    }
+
+    #[test]
+    fn the_idle_page_wakes_once_for_a_device_change_and_stays_quiet_without_one() {
+        let (a, b) = (Some("web 256f:c63a".to_string()), Some("web 1234:5678".to_string()));
+        let still = Axes::default();
+        let last_frame_read_a: Cached = (a.clone(), None);
+        assert!(!wakes(Some((a.clone(), still)), &last_frame_read_a), "A, at rest");
+        assert!(wakes(Some((b.clone(), still)), &last_frame_read_a), "A to B: a frame looks at B");
+        assert!(wakes(None, &last_frame_read_a), "A to none: a frame shows it's gone");
+        assert!(!wakes(None, &(None, None)), "none to none: quiet");
+    }
+
     #[test]
     fn gamepads_and_other_logitech_devices_are_not_3d_mice() {
         for id in [
@@ -280,6 +362,6 @@ mod tests {
         assert_eq!(choose([(Source::VirtualJoystick, other)]), Some(other));
         // Two devices: the first listed.
         assert_eq!(choose([(Source::Device, moving), (Source::Device, other)]), Some(moving));
-        assert_eq!(choose([]), None);
+        assert_eq!(choose::<Axes>([]), None);
     }
 }

apps/solidcraft/Cargo.toml

@@ -7,9 +7,14 @@ license.workspace = true
 publish = false
 default-run = "solidcraft"
 
+[features]
+default = ["raytrace-cpu", "bundled-render-library"]
+bundled-render-library = ["solidcraft-engine/bundled-render-library"]
+raytrace-cpu = ["solidcraft-engine/raytrace-cpu"]
+
 # The workspace lints, except unsafe_code: denied, not forbidden, so that src/open_documents.rs
 # (macOS file-open events), src/native_crash.rs (Windows exception filter) and src/native_frame.rs
-# (Windows resize border) can allow it: none has a safe API. Keep the rest in sync with [workspace.lints].
+# (Windows resize border, taskbar icon) can allow it: none has a safe API. Keep the rest in sync with [workspace.lints].
 [lints.rust]
 unsafe_code = "deny"
 
@@ -49,9 +54,15 @@ hidapi = { version = "2.6.7", default-features = false, features = ["windows-nat
 # The main window's handle for src/native_frame.rs (already in the tree through eframe and winit).
 raw-window-handle = "0.6"
 # Native crash capture (src/native_crash.rs): the exception filter, the faulting module, a minidump.
-# The window's resize border and DPI size (src/native_frame.rs): the window procedure, hit test, DPI.
+# The window's resize border, DPI size and class icon (src/native_frame.rs): the window procedure, hit
+# test, DPI, the exe's icon.
+# Finding 3D mice through Plug and Play without asking other devices anything (src/space_mouse/windows_hid.rs).
 windows-sys = { version = "0.61", features = [
+    "Win32_Devices_DeviceAndDriverInstallation",
+    "Win32_Devices_HumanInterfaceDevice",
+    "Win32_Devices_Properties",
     "Win32_Foundation",
+    "Win32_Graphics_Gdi",
     "Win32_Security",
     "Win32_Storage_FileSystem",
     "Win32_System_Diagnostics_Debug",
@@ -65,15 +76,17 @@ windows-sys = { version = "0.61", features = [
 ] }
 
 [target.'cfg(target_os = "macos")'.dependencies]
+muda = { version = "0.21.2", default-features = false }
 # The 3D mouse through the 3Dconnexion driver, which keeps the device to itself (src/space_mouse.rs).
 solidcraft-3dx-client = { workspace = true }
 # The 3D mouse (src/space_mouse.rs), in the shared-device open mode so that a running 3DxWare
 # driver does not shut the app out.
 hidapi = { version = "2.6.7", default-features = false, features = ["macos-shared-device"] }
-# Files opened from Finder and the Dock (src/open_documents.rs); all already come with eframe and rfd.
+# Files opened from Finder and the Dock (src/open_documents.rs), and the fullscreen title-bar
+# inset (src/main.rs); all already come with eframe and rfd.
 objc2 = "0.6"
-objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "NSApplication", "NSResponder"] }
-objc2-foundation = { version = "0.3", default-features = false, features = ["std", "block2", "NSArray", "NSNotification", "NSOperation", "NSString", "NSURL"] }
+objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "NSApplication", "NSResponder", "NSWindow"] }
+objc2-foundation = { version = "0.3", default-features = false, features = ["std", "block2", "NSArray", "NSNotification", "NSOperation", "NSProcessInfo", "NSString", "NSURL"] }
 block2 = "0.6"
 
 [target.'cfg(all(unix, not(target_os = "macos")))'.dependencies]

apps/solidcraft/src/control_server.rs

@@ -3,13 +3,15 @@
 
 use std::io::{BufRead, BufReader, Write};
 use std::net::{TcpListener, TcpStream};
-use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicU64, AtomicUsize, Ordering};
 use std::sync::mpsc::{Receiver, Sender, TryRecvError, channel};
-use std::time::Duration;
+use std::sync::{Arc, Mutex, MutexGuard, PoisonError};
+use std::time::{Duration, Instant};
 
 use serde_json::{Value, json};
 use solidcraft_engine::MAX_LINE;
 use solidcraft_engine::control_auth;
+use solidcraft_engine::control_pending;
 use solidcraft_ui_egui::ControlRequest;
 
 /// Connections served at once, so a flood must not be able to spawn threads without end.
@@ -18,7 +20,7 @@ const MAX_CONNECTIONS: usize = 16;
 const MAX_BAD_LINES: usize = 8;
 
 static OPEN: AtomicUsize = AtomicUsize::new(0);
-/// The token files this launch wrote (its `--control` port, the agent chat's endpoint), removed
+/// The token files this launch wrote (its control port, the agent chat's endpoint), removed
 /// when the app ends.
 static TOKEN_FILES: std::sync::Mutex<Vec<std::path::PathBuf>> = std::sync::Mutex::new(Vec::new());
 
@@ -33,17 +35,45 @@ fn new_token() -> Option<String> {
 pub fn remove_token_file() {
     if let Ok(files) = TOKEN_FILES.lock() {
         for p in files.iter() {
-            let _ = std::fs::remove_file(p);
+            control_auth::remove_token_file(p);
         }
     }
+    if let Some(port) = APP_PORT.lock().ok().and_then(|p| *p) {
+        control_auth::remove_current_port(port);
+    }
 }
 
-pub fn start(port: u16, ctx: egui::Context) -> Receiver<ControlRequest> {
+/// The port the app's own channel listens on, for removing the discovery file at exit.
+static APP_PORT: std::sync::Mutex<Option<u16>> = std::sync::Mutex::new(None);
+
+pub fn start(listen_on: control_auth::Listen, ctx: egui::Context) -> Receiver<ControlRequest> {
     let (tx, rx) = channel::<ControlRequest>();
     // Every connection must show the token before anything runs (docs/control-protocol.md).
     match control_auth::env_token().or_else(new_token) {
         Some(token) => {
-            listen(port, token, tx, ctx, false);
+            let listener = match listen_on {
+                control_auth::Listen::Exact(port) => TcpListener::bind(("127.0.0.1", port)),
+                control_auth::Listen::Default => control_auth::bind_with_fallback(control_auth::DEFAULT_PORT, control_auth::PORT_TRIES),
+            };
+            match listener {
+                Ok(l) => {
+                    if let Some(port) = listen_on_listener(l, token, tx, ctx, false) {
+                        if matches!(listen_on, control_auth::Listen::Default) {
+                            eprintln!("solidcraft: control channel on the default port 127.0.0.1:{port} (Preferences > Assistant turns it off)");
+                        }
+                        // The discovery file: where `solidcraft-cli mcp` finds this app with no arguments.
+                        match control_auth::write_current_port(port) {
+                            Ok(_) => {
+                                if let Ok(mut p) = APP_PORT.lock() {
+                                    *p = Some(port);
+                                }
+                            }
+                            Err(e) => eprintln!("solidcraft: could not write the control discovery file ({e})"),
+                        }
+                    }
+                }
+                Err(e) => eprintln!("solidcraft: control server failed to bind 127.0.0.1: {e}"),
+            }
         }
         None => eprintln!("solidcraft: control server not started: no random token available"),
     }
@@ -59,20 +89,20 @@ pub fn listen_agent(tx: Sender<ControlRequest>, ctx: egui::Context) -> Option<u1
         eprintln!("solidcraft: agent chat endpoint not started: no random token available");
         return None;
     };
-    listen(0, token, tx, ctx, true)
-}
-
-/// Listen on `port` (0: a free port the system picks) with `token`; the port it listens on.
-/// `patient`: every request may wait as long as a batch (a person decides on it).
-fn listen(port: u16, token: String, tx: Sender<ControlRequest>, ctx: egui::Context, patient: bool) -> Option<u16> {
-    let listener = match TcpListener::bind(("127.0.0.1", port)) {
+    let listener = match TcpListener::bind(("127.0.0.1", 0)) {
         Ok(l) => l,
         Err(e) => {
-            eprintln!("solidcraft: control server failed to bind 127.0.0.1:{port}: {e}");
+            eprintln!("solidcraft: control server failed to bind 127.0.0.1: {e}");
             return None;
         }
     };
-    let port = listener.local_addr().map(|a| a.port()).unwrap_or(port);
+    listen_on_listener(listener, token, tx, ctx, true)
+}
+
+/// Serve `listener` (loopback) with `token`; the port it listens on.
+/// `patient`: every request may wait as long as a batch (a person decides on it).
+fn listen_on_listener(listener: TcpListener, token: String, tx: Sender<ControlRequest>, ctx: egui::Context, patient: bool) -> Option<u16> {
+    let port = listener.local_addr().ok()?.port();
     match control_auth::token_path(port) {
         Some(path) => match control_auth::write_token_file(&path, &token) {
             Ok(()) => {
@@ -97,7 +127,7 @@ fn listen(port: u16, token: String, tx: Sender<ControlRequest>, ctx: egui::Conte
             if OPEN.fetch_add(1, Ordering::Relaxed) >= MAX_CONNECTIONS {
                 OPEN.fetch_sub(1, Ordering::Relaxed);
                 let mut refused = stream;
-                let _ = writeln!(refused, "{}", json!({"ok": false, "error": "too many connections"}));
+                let _ = send(&mut refused, &json!({"ok": false, "error": "too many connections"}));
                 continue;
             }
             let tx = tx.clone();
@@ -144,6 +174,15 @@ fn read_line(r: &mut impl BufRead, max: usize) -> std::io::Result<Option<Vec<u8>
     }
 }
 
+/// A reply line, written to the socket at once. `writeln!` with a JSON value hands the socket each
+/// of its pieces apart, a system call for every string, number and comma: half a second for a
+/// design's component tree when it has thousands of components.
+fn send(out: &mut impl Write, reply: &Value) -> std::io::Result<()> {
+    let mut line = serde_json::to_vec(reply).map_err(std::io::Error::other)?;
+    line.push(b'\n');
+    out.write_all(&line)
+}
+
 /// The reply to a connection that didn't show the token; the connection is then closed.
 fn unauthorized() -> Value {
     json!({"ok": false, "error": "unauthorized: send the control token as \"token\" (see docs/control-protocol.md)"})
@@ -154,7 +193,7 @@ fn unauthorized() -> Value {
 /// the connection, and a reset can reach the client before it has read the refusal.
 fn refuse(out: &mut TcpStream, reader: &mut BufReader<TcpStream>) {
     use std::io::Read;
-    let _ = writeln!(out, "{}", unauthorized());
+    let _ = send(out, &unauthorized());
     let _ = out.shutdown(std::net::Shutdown::Write);
     let _ = reader.get_ref().set_read_timeout(Some(Duration::from_millis(500)));
     let _ = std::io::copy(&mut reader.by_ref().take(64 * 1024), &mut std::io::sink());
@@ -175,14 +214,171 @@ const WAITS: Waits = Waits { short: Duration::from_secs(60), long: Duration::fro
 struct Pending {
     id: Value,
     method: String,
+    /// The request in messages ("`engine.execute` (solid.fillet)").
+    what: String,
     reply: Receiver<Value>,
 }
 
-fn serve(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: egui::Context, patient: bool) {
-    serve_with(stream, token, tx, ctx, patient, WAITS);
+/// Every request the app has been sent and not answered yet, from every connection, for
+/// `control.running` (#3654). Each connection's own thread answers that, so it never waits behind
+/// a running request.
+struct Running {
+    list: Mutex<Vec<InFlight>>,
+    connections: AtomicU64,
+    keys: AtomicU64,
 }
 
-fn serve_with(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: egui::Context, patient: bool, waits: Waits) {
+/// What `control.running` says about a request: never its parameters beyond the command id.
+struct InFlight {
+    key: u64,
+    connection: u64,
+    id: Value,
+    method: String,
+    command: Option<&'static str>,
+    steps: Option<usize>,
+    since: Instant,
+    started: Arc<AtomicBool>,
+}
+
+/// The app's requests, from both of its listeners.
+static RUNNING: Running = Running::new();
+
+impl Running {
+    const fn new() -> Self {
+        Running { list: Mutex::new(Vec::new()), connections: AtomicU64::new(0), keys: AtomicU64::new(0) }
+    }
+
+    fn lock(&self) -> MutexGuard<'_, Vec<InFlight>> {
+        self.list.lock().unwrap_or_else(PoisonError::into_inner)
+    }
+
+    /// List `req`, sent on `connection`, until the returned ticket is dropped.
+    fn add(&'static self, connection: u64, id: &Value, req: &ControlRequest) -> Ticket {
+        let key = self.keys.fetch_add(1, Ordering::Relaxed);
+        // Ids and methods come from the client: only short ones are repeated to the others.
+        let id = match id {
+            Value::Number(_) => id.clone(),
+            Value::String(s) if s.len() <= 64 => id.clone(),
+            _ => Value::Null,
+        };
+        let p = &req.params;
+        let command = match req.method.as_str() {
+            "engine.execute" | "command" => p.get("command").and_then(Value::as_str).and_then(solidcraft_engine::find_command).map(|c| c.id),
+            _ => None,
+        };
+        let steps = match req.method.as_str() {
+            "engine.batch" | "engine.script" => p.get("commands").and_then(Value::as_array).map(Vec::len),
+            _ => None,
+        };
+        let method = req.method.chars().take(64).collect();
+        let started = req.started.clone();
+        self.lock().push(InFlight { key, connection, id, method, command, steps, since: Instant::now(), started });
+        Ticket { running: self, key }
+    }
+
+    /// The `control.running` result, as `asker`'s connection sees it.
+    fn result(&self, asker: u64) -> Value {
+        let rows: Vec<Value> = self
+            .lock()
+            .iter()
+            .map(|e| {
+                let mut r = json!({
+                    "connection": e.connection,
+                    "id": e.id,
+                    "method": e.method,
+                    "running_s": (e.since.elapsed().as_secs_f64() * 10.0).round() / 10.0,
+                    "queued": !e.started.load(Ordering::Relaxed),
+                });
+                if let Some(c) = e.command {
+                    r["command"] = json!(c);
+                }
+                if let Some(n) = e.steps {
+                    r["steps"] = json!(n);
+                }
+                if e.connection == asker {
+                    r["self"] = json!(true);
+                }
+                r
+            })
+            .collect();
+        json!({"running": rows})
+    }
+}
+
+/// A listed request; dropped when its reply arrives.
+struct Ticket {
+    running: &'static Running,
+    key: u64,
+}
+
+impl Drop for Ticket {
+    fn drop(&mut self) {
+        let key = self.key;
+        self.running.lock().retain(|e| e.key != key);
+    }
+}
+
+/// The reply to a timed-out request, received on a thread of its own so the request stays listed
+/// until the app answers, also once its connection has closed (#3654).
+fn watch(reply: Receiver<Value>, ticket: Ticket) -> Receiver<Value> {
+    let (late_tx, late_rx) = channel();
+    // A small thread per timed-out request (each connection has at most one). If none can be
+    // made, the reply is lost and `control.pending` says the app ended the request without one.
+    // The reply is passed on before the request leaves the list: once `control.running` no longer
+    // shows it, its connection's `control.pending` has it.
+    let _ = std::thread::Builder::new().stack_size(64 * 1024).spawn(move || {
+        if let Ok(v) = reply.recv() {
+            let _ = late_tx.send(v);
+        }
+        drop(late_tx);
+        drop(ticket);
+    });
+    late_rx
+}
+
+/// The reply text for a request that outlasts its wait. A request that only reads changes
+/// nothing when it finishes; an export or a save still writes its file, and any other request
+/// still applies, as it was not cancelled.
+fn timeout_message(what: &str, effect: control_pending::Effect) -> String {
+    match effect {
+        control_pending::Effect::ReadsOnly => {
+            format!("timeout: {what} is still running in the app ({}); ask `control.pending` for its answer", effect.when_done())
+        }
+        control_pending::Effect::WritesFile => format!(
+            "timeout: {what} is still running in the app and will still write the file when it finishes (it was not cancelled: \
+             don't send it again; the design does not change); ask `control.pending` for its result"
+        ),
+        control_pending::Effect::Changes => format!(
+            "timeout: {what} is still running in the app and will still apply when it finishes (it was not cancelled: don't send it \
+             again); ask `control.pending` for its result"
+        ),
+    }
+}
+
+/// The reply text for a request refused because an earlier one on the connection still runs.
+fn busy_message(p: &Pending, method: &str) -> String {
+    let method: String = method.chars().take(128).collect();
+    format!(
+        "busy: request {} ({}) is still running, so `{method}` was not run; ask `control.pending` for that request's result, then \
+         send this one again",
+        p.id, p.what
+    )
+}
+
+fn serve(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: egui::Context, patient: bool) {
+    serve_with(stream, token, tx, ctx, patient, WAITS, &RUNNING);
+}
+
+fn serve_with(
+    stream: TcpStream,
+    token: &str,
+    tx: Sender<ControlRequest>,
+    ctx: egui::Context,
+    patient: bool,
+    waits: Waits,
+    running: &'static Running,
+) {
+    let connection = running.connections.fetch_add(1, Ordering::Relaxed) + 1;
     let Ok(read) = stream.try_clone() else { return };
     let mut out = stream;
     let mut reader = BufReader::new(read);
@@ -194,7 +390,7 @@ fn serve_with(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: e
             Ok(Some(l)) => String::from_utf8_lossy(&l).into_owned(),
             Ok(None) => break,
             Err(e) => {
-                let _ = writeln!(out, "{}", json!({"ok": false, "error": e.to_string()}));
+                let _ = send(&mut out, &json!({"ok": false, "error": e.to_string()}));
                 break;
             }
         };
@@ -216,13 +412,16 @@ fn serve_with(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: e
                 let id = msg.get("id").cloned().unwrap_or(Value::Null);
                 let method = msg.get("method").and_then(Value::as_str).unwrap_or("").to_string();
                 let params = msg.get("params").cloned().unwrap_or(json!({}));
-                // A request that timed out may have finished since (#1618).
-                let late = pending.as_ref().and_then(|p| match p.reply.try_recv() {
+                // A request that timed out may have finished since (#1618). `control.running` only
+                // looks, so it leaves that reply where it is.
+                let late = pending.as_ref().filter(|_| method != "control.running").and_then(|p| match p.reply.try_recv() {
                     Ok(reply) => Some(reply),
                     Err(TryRecvError::Disconnected) => Some(json!({"ok": false, "error": "the app ended the request without a reply"})),
                     Err(TryRecvError::Empty) => None,
                 });
-                let mut r = if method == "control.pending" {
+                let mut r = if method == "control.running" {
+                    json!({"ok": true, "result": running.result(connection)})
+                } else if method == "control.pending" {
                     match (pending.take(), late) {
                         (None, _) => json!({"ok": true, "result": {"pending": null}}),
                         (Some(p), Some(reply)) => json!({"ok": true, "result": {"pending": p.id, "method": p.method, "done": true, "reply": reply}}),
@@ -234,7 +433,7 @@ fn serve_with(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: e
                     }
                 } else if let Some(p) = pending.as_ref().filter(|_| late.is_none()) {
                     // Nothing more is queued behind it, to run unseen when it ends.
-                    json!({"ok": false, "busy": true, "error": format!("busy: request {} (`{}`) is still running; ask `control.pending` for its result", p.id, p.method)})
+                    json!({"ok": false, "busy": true, "error": busy_message(p, &method)})
                 } else {
                     if late.is_some() {
                         // Finished, and the client moved on without asking: it is dropped.
@@ -242,7 +441,10 @@ fn serve_with(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: e
                     }
                     // A batch replaces many short requests: the whole of it may take long (#743).
                     let wait = if patient || method == "engine.batch" { waits.long } else { waits.short };
+                    let what = control_pending::describe(&method, &params);
+                    let effect = control_pending::effect(&method, &params);
                     let (req, rrx) = ControlRequest::new(method.clone(), params);
+                    let ticket = running.add(connection, &id, &req);
                     if tx.send(req).is_err() {
                         break;
                     }
@@ -250,8 +452,8 @@ fn serve_with(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: e
                     match rrx.recv_timeout(wait) {
                         Ok(r) => r,
                         Err(_) => {
-                            let r = json!({"ok": false, "running": true, "error": format!("timeout: `{method}` is still running in the app and will still apply; ask `control.pending` for its result")});
-                            pending = Some(Pending { id: id.clone(), method, reply: rrx });
+                            let r = json!({"ok": false, "running": true, "error": timeout_message(&what, effect)});
+                            pending = Some(Pending { id: id.clone(), method, what, reply: watch(rrx, ticket) });
                             r
                         }
                     }
@@ -270,7 +472,7 @@ fn serve_with(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: e
                 json!({"ok": false, "error": format!("bad JSON: {e}")})
             }
         };
-        if writeln!(out, "{reply}").is_err() {
+        if send(&mut out, &reply).is_err() {
             break;
         }
         if bad >= MAX_BAD_LINES {
@@ -307,9 +509,10 @@ mod tests {
             }
         });
         let waits = Waits { short: Duration::from_millis(100), long: Duration::from_millis(100) };
+        static RUNNING: Running = Running::new();
         std::thread::spawn(move || {
             if let Some(stream) = listener.incoming().flatten().next() {
-                serve_with(stream, token, tx, egui::Context::default(), false, waits);
+                serve_with(stream, token, tx, egui::Context::default(), false, waits, &RUNNING);
             }
         });
         let s = TcpStream::connect(addr).unwrap();
@@ -349,6 +552,121 @@ mod tests {
         assert_eq!(*ran.lock().unwrap(), ["slow", "ui.view"], "the busy request never reached the app");
     }
 
+    /// #3654: `control.running` answers on every connection, at once, with what any connection
+    /// has the app running or queued (command ids, never parameters); a timed-out request stays
+    /// listed until the app answers it, and an idle app lists nothing.
+    #[test]
+    fn every_connection_sees_what_the_app_is_running() {
+        static RUNNING: Running = Running::new();
+        let token = "0123456789abcdef0123456789abcdef";
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let addr = listener.local_addr().unwrap();
+        let (tx, rx) = channel::<ControlRequest>();
+        // The window: one request at a time, as `drain_control` takes them; the export is held
+        // until the test lets it go.
+        let (gate_tx, gate_rx) = channel::<()>();
+        std::thread::spawn(move || {
+            for req in rx {
+                req.started.store(true, Ordering::Relaxed);
+                if req.method == "engine.execute" {
+                    let _ = gate_rx.recv();
+                }
+                let _ = req.reply.send(json!({"ok": true, "result": req.method}));
+            }
+        });
+        let waits = Waits { short: Duration::from_millis(100), long: Duration::from_secs(60) };
+        std::thread::spawn(move || {
+            for stream in listener.incoming().flatten() {
+                let tx = tx.clone();
+                std::thread::spawn(move || serve_with(stream, token, tx, egui::Context::default(), false, waits, &RUNNING));
+            }
+        });
+        let open = || {
+            let s = TcpStream::connect(addr).unwrap();
+            s.set_read_timeout(Some(Duration::from_secs(10))).unwrap();
+            let mut out = s.try_clone().unwrap();
+            let mut lines = BufReader::new(s);
+            move |v: Value| -> Value {
+                writeln!(out, "{v}").unwrap();
+                let mut l = String::new();
+                lines.read_line(&mut l).unwrap();
+                serde_json::from_str(&l).unwrap()
+            }
+        };
+        let running = |ask: &mut dyn FnMut(Value) -> Value, until: &dyn Fn(&[Value]) -> bool| {
+            let deadline = Instant::now() + Duration::from_secs(10);
+            loop {
+                let r = ask(json!({"id": 0, "method": "control.running", "token": token}));
+                let rows = r["result"]["running"].as_array().cloned().unwrap_or_default();
+                if until(&rows) || Instant::now() > deadline {
+                    return (r, rows);
+                }
+                std::thread::sleep(Duration::from_millis(10));
+            }
+        };
+        let mut watcher = open();
+        let (r, rows) = running(&mut watcher, &|_| true);
+        assert!(r["ok"] == true && rows.is_empty(), "idle: {r}");
+
+        let mut export = open();
+        let path = "/private/part.step";
+        let params = json!({"command": "file.export", "params": {"path": path}});
+        let r = export(json!({"id": 7, "method": "engine.execute", "params": params, "token": token}));
+        assert_eq!(r["running"], true, "{r}");
+        // A batch from another connection waits behind the export.
+        let mut batch = open();
+        let queued = std::thread::spawn(move || {
+            let steps = json!([{"command": "solid.box"}, {"command": "solid.box"}]);
+            batch(json!({"id": "b", "method": "engine.batch", "params": {"commands": steps}, "token": token}))
+        });
+        // The window may not have taken the export yet, even though it timed out.
+        let (r, rows) = running(&mut watcher, &|rows| rows.len() == 2 && rows[0]["queued"] == false);
+        assert_eq!(rows.len(), 2, "{r}");
+        let (e, b) = (&rows[0], &rows[1]);
+        assert_eq!(
+            (&e["id"], &e["method"], &e["command"], &e["queued"]),
+            (&json!(7), &json!("engine.execute"), &json!("file.export"), &json!(false)),
+            "{r}"
+        );
+        assert!(e["running_s"].as_f64().is_some_and(|s| s >= 0.1), "{r}");
+        assert_eq!((&b["id"], &b["method"], &b["steps"], &b["queued"]), (&json!("b"), &json!("engine.batch"), &json!(2), &json!(true)), "{r}");
+        assert_ne!(e["connection"], b["connection"], "{r}");
+        assert!(rows.iter().all(|row| row.get("self").is_none()), "{r}");
+        assert!(!r.to_string().contains(path), "parameters stay with their connection: {r}");
+        // The connection whose request timed out may ask too, and sees its own marked.
+        let r = export(json!({"id": 8, "method": "control.running"}));
+        let own: Vec<&Value> = r["result"]["running"].as_array().unwrap().iter().filter(|row| row["self"] == true).collect();
+        assert_eq!(own.len(), 1, "{r}");
+        assert_eq!(own[0]["command"], "file.export", "{r}");
+
+        gate_tx.send(()).unwrap();
+        assert_eq!(queued.join().unwrap()["result"], "engine.batch");
+        let (r, rows) = running(&mut watcher, &|rows| rows.is_empty());
+        assert!(rows.is_empty(), "done: {r}");
+        // Asking `control.running` did not take the export's reply from its connection.
+        let r = export(json!({"id": 9, "method": "control.pending"}));
+        assert_eq!((&r["result"]["pending"], &r["result"]["done"]), (&json!(7), &json!(true)), "{r}");
+    }
+
+    /// A timed-out request that only reads is not said to "still apply", nor is one that only
+    /// writes a file (an export, #1989); a change is, by name.
+    #[test]
+    fn timeout_text_tells_reads_from_changes() {
+        let says = |method: &str, p: Value| timeout_message(&control_pending::describe(method, &p), control_pending::effect(method, &p));
+        let read = says("ui.inspect", json!({}));
+        assert!(read.starts_with("timeout") && read.contains("only reads") && !read.contains("will still apply"), "{read}");
+        let read = says("engine.execute", json!({"command": "sketch.inspect"}));
+        assert!(read.contains("only reads") && read.contains("sketch.inspect"), "{read}");
+        let change = says("engine.execute", json!({"command": "solid.fillet"}));
+        assert!(change.starts_with("timeout") && change.contains("will still apply") && change.contains("solid.fillet"), "{change}");
+        let export = says("engine.execute", json!({"command": "file.export", "params": {"path": "/tmp/wall.step"}}));
+        assert!(export.contains("will still write the file") && !export.contains("apply") && export.contains("file.export"), "{export}");
+        let save = says("engine.execute", json!({"command": "file.save"}));
+        assert!(save.contains("will still write the file") && !save.contains("apply"), "{save}");
+        let render = says("ui.render", json!({"path": "/tmp/a.png"}));
+        assert!(render.contains("will still write the file"), "{render}");
+    }
+
     /// #205: a connection runs nothing until a request carries the launch's token; a wrong or
     /// missing token, or garbage, is refused and the connection closed. Once shown, the token
     /// need not be repeated on that connection.
@@ -441,4 +759,31 @@ mod tests {
         let mut r = BufReader::with_capacity(64, text.as_slice());
         assert!(read_line(&mut r, 1000).is_err());
     }
+
+    /// A large reply reaches the socket in one write, not one per JSON piece (a component tree of
+    /// thousands of components took half a second to send), and reads back as it was.
+    #[test]
+    fn a_large_reply_is_written_at_once() {
+        struct Counted {
+            writes: usize,
+            bytes: Vec<u8>,
+        }
+        impl Write for Counted {
+            fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
+                self.writes += 1;
+                self.bytes.extend_from_slice(buf);
+                Ok(buf.len())
+            }
+            fn flush(&mut self) -> std::io::Result<()> {
+                Ok(())
+            }
+        }
+        let components: Vec<Value> = (0..2000).map(|i| json!({"id": i, "name": format!("Part {i}"), "bodies": ["a", "b"], "parent": 0})).collect();
+        let reply = json!({"ok": true, "id": 7, "result": {"components": components}});
+        let mut out = Counted { writes: 0, bytes: Vec::new() };
+        send(&mut out, &reply).unwrap();
+        assert_eq!(out.writes, 1);
+        assert_eq!(out.bytes.last(), Some(&b'\n'));
+        assert_eq!(serde_json::from_slice::<Value>(&out.bytes).unwrap(), reply);
+    }
 }

apps/solidcraft/src/device_lost.rs

@@ -0,0 +1,91 @@
+//! The graphics device was lost after the window opened: the driver was reset (on Windows a TDR,
+//! "Display driver stopped responding and has recovered") or the GPU went away (#4172). A lost
+//! device can't draw again, so the window can't show anything more, not even a message. The
+//! painter stops drawing (`egui_wgpu::DeviceLost`); the app then closes, keeping unsaved changes
+//! for recovery as a forced quit does, and starts again ([`restart`]), and the new start says what
+//! happened ([`note`]). A device lost again soon after such a restart starts the next one on the
+//! software renderer, which doesn't depend on the graphics driver.
+
+use crate::startup;
+
+/// Set on the start after a lost device: when the device was lost (seconds since 1970).
+pub const LOST_ENV: &str = "SOLIDCRAFT_DEVICE_LOST";
+
+/// A loss this recent (seconds) counts for the start after it: its note, and a second loss
+/// within it starts on the software renderer. Inherited by later starts, an older stamp is
+/// ignored.
+const RECENT_SECS: u64 = 600;
+
+/// Seconds since 1970.
+pub fn now_secs() -> u64 {
+    std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_secs())
+}
+
+/// Whether `stamp` ([`LOST_ENV`]) names a loss at most [`RECENT_SECS`] before `now`.
+pub fn recent(stamp: Option<&str>, now: u64) -> bool {
+    stamp.and_then(|s| s.trim().parse::<u64>().ok()).is_some_and(|at| at <= now && now - at <= RECENT_SECS)
+}
+
+/// Whether the start after a lost device uses the software renderer: when this launch already
+/// followed a recent loss (the driver keeps losing it), or ran on it anyway.
+pub fn restart_on_software(after_recent_loss: bool, cpu_renderer: bool) -> bool {
+    after_recent_loss || cpu_renderer
+}
+
+/// What the start after a lost device tells the user, `software` when it runs on the software
+/// renderer.
+pub fn note(software: bool) -> String {
+    let mut note = String::from(
+        "The graphics device was reset (the graphics driver stopped responding), so SolidCraft closed and started again. Unsaved changes were kept for recovery.",
+    );
+    if software {
+        note.push_str(" This start uses software rendering, which doesn't depend on the graphics driver.");
+    }
+    note
+}
+
+/// Start SolidCraft again with the same arguments, the loss stamped at `lost_at`, on the software
+/// renderer when `software`.
+pub fn restart(software: bool, lost_at: u64) {
+    let Ok(exe) = std::env::current_exe() else { return };
+    let mut command = std::process::Command::new(exe);
+    command.args(std::env::args_os().skip(1)).env(LOST_ENV, lost_at.to_string());
+    if software {
+        command.env(startup::RENDERER_ENV, "cpu");
+    }
+    #[cfg(windows)]
+    {
+        use std::os::windows::process::CommandExt;
+        // Not tied to this process: its own process group, no console.
+        command.creation_flags(0x0000_0200 | 0x0000_0008);
+    }
+    if let Err(e) = command.spawn() {
+        log::error!("graphics: starting again after the device was lost: {e}");
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    /// Only a recent, well-formed stamp counts: a later start that inherited it says nothing.
+    #[test]
+    fn only_a_recent_loss_counts() {
+        let now = 1_000_000;
+        assert!(super::recent(Some("999990"), now));
+        assert!(super::recent(Some(" 999400 "), now));
+        assert!(!super::recent(Some("999399"), now), "older than ten minutes");
+        assert!(!super::recent(Some("1000001"), now), "from the future");
+        assert!(!super::recent(Some("soon"), now));
+        assert!(!super::recent(None, now));
+    }
+
+    /// The first loss starts again on the GPU; a second one soon after, on the software renderer.
+    #[test]
+    fn a_second_loss_in_a_row_starts_on_the_software_renderer() {
+        assert!(!super::restart_on_software(false, false));
+        assert!(super::restart_on_software(true, false));
+        assert!(super::restart_on_software(false, true));
+        assert!(super::note(true).contains("software rendering"));
+        assert!(!super::note(false).contains("software rendering"));
+        assert!(super::note(false).contains("kept for recovery"));
+    }
+}

apps/solidcraft/src/main.rs

@@ -8,8 +8,10 @@
 //! A `.step`/`.stp` file opens as a new design holding the file's bodies (an Import feature); a
 //! `.3mf`/`.stl`/`.obj`/`.glb`/`.gltf` file as a new design holding mesh bodies.
 //!
+//! `SOLIDCRAFT_SETTINGS_DIR` selects an explicit absolute settings directory without legacy adoption.
 //! `--control <port>` (or `SOLIDCRAFT_CONTROL_PORT`) starts a localhost JSON-lines control
 //! server: `{"id":1,"method":"engine.execute","params":{"command":"solid.box","params":{…}}}`.
+//! Without them the channel still opens, on the default port, unless Preferences turns it off.
 //! See `solidcraft_ui_egui::control` and docs/control-protocol.md.
 #![cfg_attr(all(target_os = "windows", not(debug_assertions)), windows_subsystem = "windows")]
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
@@ -19,42 +21,109 @@
 #[path = "../../../assets/icons/app/shared/source/app_icon.rs"]
 mod app_icon;
 mod control_server;
+mod device_lost;
 #[cfg(target_os = "windows")]
 mod native_crash;
 #[cfg(target_os = "windows")]
 mod native_frame;
 #[cfg(target_os = "macos")]
+mod native_menu;
+#[cfg(target_os = "macos")]
 mod open_documents;
 #[cfg(any(target_os = "windows", target_os = "linux", target_os = "macos"))]
 mod space_mouse;
 mod startup;
+#[cfg(any(target_os = "windows", test))]
+mod window_fit;
 
 use solidcraft_engine::{Session, io};
 use solidcraft_ui_egui::{Services, SolveApp};
 
+/// Windows: put the restored window back inside the monitor's work area if it is out of reach
+/// (a gone monitor, another scale, a taskbar edge). Sizes are in points, the work area in pixels.
+#[cfg(target_os = "windows")]
+fn fit_window_to_work_area(ctx: &egui::Context, frame: &eframe::Frame) {
+    use window_fit::Area;
+    let Some((x, y, w, h)) = native_frame::work_area(frame) else { return };
+    let (outer, inner, scale, maximized) = ctx.input(|i| {
+        let v = i.viewport();
+        (v.outer_rect, v.inner_rect, v.native_pixels_per_point, v.maximized.unwrap_or(false) || v.fullscreen.unwrap_or(false))
+    });
+    let (Some(outer), Some(inner), Some(scale)) = (outer, inner, scale.filter(|s| s.is_finite() && *s > 0.0)) else { return };
+    if maximized {
+        return;
+    }
+    let work = Area::new(x as f32 / scale, y as f32 / scale, w as f32 / scale, h as f32 / scale);
+    let now = Area::new(outer.min.x, outer.min.y, outer.width(), outer.height());
+    let fitted = window_fit::fit(now, work, (960.0, 600.0));
+    if fitted != now {
+        // The frame (title bar, borders) keeps its size; only the inner size follows.
+        let inner_size = egui::vec2((inner.width() - (now.w - fitted.w)).max(1.0), (inner.height() - (now.h - fitted.h)).max(1.0));
+        ctx.send_viewport_cmd(egui::ViewportCommand::InnerSize(inner_size));
+        ctx.send_viewport_cmd(egui::ViewportCommand::OuterPosition(egui::pos2(fitted.x, fitted.y)));
+    }
+}
+
+/// `SOLIDCRAFT_PROFILE_STARTUP=1` prints the time since launch at each startup step.
+fn mark(step: &str) {
+    static START: std::sync::OnceLock<(std::time::Instant, bool)> = std::sync::OnceLock::new();
+    let (start, on) = START.get_or_init(|| (std::time::Instant::now(), solidcraft_engine::geom::env::var_os("PROFILE_STARTUP").is_some()));
+    if *on {
+        eprintln!("startup {:>6.0} ms  {step}", start.elapsed().as_secs_f64() * 1000.0);
+    }
+}
+
 struct App {
     solve: SolveApp,
     /// The settings folder whose start marker the first frame clears (`startup::started`).
     starting: Option<std::path::PathBuf>,
     /// Frames begun; the second one means the first was drawn (startup is over).
     frames: u32,
+    /// Started over the control channel: the window doesn't ask for the foreground.
+    take_focus_unwanted: bool,
+    /// The graphics device: lost, it can't draw again (`App::watch_device`, #4172).
+    gpu: Option<LostWatch>,
     #[cfg(any(target_os = "windows", target_os = "linux", target_os = "macos"))]
     space_mouse: space_mouse::SpaceMouse,
+    #[cfg(target_os = "macos")]
+    native_menu: Option<native_menu::NativeMenu>,
 }
 
 impl eframe::App for App {
     fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
         if self.frames < 2 {
             self.frames += 1;
+            // Before the window is shown: its title bar must be within reach (window_fit.rs).
+            #[cfg(target_os = "windows")]
+            if self.frames == 1 {
+                fit_window_to_work_area(ctx, _frame);
+            }
+            mark(if self.frames == 1 { "first frame begins" } else { "second frame begins (first presented)" });
             // A second frame right away, which means the first was presented: the app is up.
             ctx.request_repaint();
             if self.frames == 2 {
+                // The window is shown only once its first frame is presented, and Windows then
+                // keeps a window of a process started from a shortcut or an installer behind the
+                // others. Ask for the foreground once, now that it is on screen; never again, so
+                // later frames don't take the focus from whatever the user moved to. Automation
+                // over the control channel keeps the focus where it is.
+                if !self.take_focus_unwanted {
+                    ctx.send_viewport_cmd(egui::ViewportCommand::Focus);
+                }
                 solidcraft_engine::crash::phase(solidcraft_engine::crash::RUNNING);
+                // A DMG install has no installer step: put solidcraft-cli on PATH, quietly.
+                #[cfg(target_os = "macos")]
+                std::thread::spawn(solidcraft_ui_egui::cli_link::install_on_launch);
+                // Automation runs (a control port was asked for) leave the user's AI apps alone.
+                if !self.take_focus_unwanted {
+                    solidcraft_ui_egui::ai_connect::begin(&mut self.solve);
+                }
                 if let Some(dir) = self.starting.take() {
                     startup::started(&dir);
                 }
             }
         }
+        self.watch_device();
         // The design on screen is the one whose commands a crash report replays.
         self.solve.session.crash_journal = solidcraft_engine::crash::enabled();
         // The OS closing the window (Alt+F4, Cmd+Q, the window manager): ask about unsaved
@@ -67,6 +136,10 @@ impl eframe::App for App {
         for f in if self.solve.file_picker_busy() { Vec::new() } else { open_documents::take() } {
             self.solve.open_path_async(&f);
         }
+        #[cfg(target_os = "macos")]
+        if let Some(menu) = &mut self.native_menu {
+            menu.tick(&mut self.solve, ctx);
+        }
         self.solve.logic(ctx);
         #[cfg(any(target_os = "windows", target_os = "linux", target_os = "macos"))]
         if !self.solve.file_picker_busy() {
@@ -76,14 +149,23 @@ impl eframe::App for App {
             ctx.send_viewport_cmd(egui::ViewportCommand::Close);
         }
     }
-    fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
+    fn raw_input_hook(&mut self, ctx: &egui::Context, raw: &mut egui::RawInput) {
+        #[cfg(target_os = "macos")]
+        if let Some(menu) = &mut self.native_menu {
+            menu.raw_input_hook(&mut self.solve, ctx, raw);
+        }
+        #[cfg(target_os = "macos")]
+        macos_fullscreen_content(ctx, raw);
         // Before the app's own hook, which adds the control channel's events.
         #[cfg(any(target_os = "windows", target_os = "linux", target_os = "macos"))]
         self.space_mouse.raw_input_hook(self.solve.preferences.space_mouse_enabled, raw);
+        // The 3D mouse's buttons, before the app reads the frame: Esc and held modifiers join its input.
+        #[cfg(any(target_os = "windows", target_os = "linux", target_os = "macos"))]
+        solidcraft_ui_egui::space_mouse::buttons_hook(&mut self.solve, ctx, self.space_mouse.buttons(), raw);
         self.solve.raw_input_hook(raw);
     }
     fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
-        self.solve.ui(ui);
+        content_ui(&mut self.solve, ui);
     }
     fn save(&mut self, storage: &mut dyn eframe::Storage) {
         storage.set_string(solidcraft_ui_egui::prefs::STORAGE_KEY, self.solve.prefs());
@@ -91,8 +173,19 @@ impl eframe::App for App {
     fn on_exit(&mut self) {
         // The agent chat's agent and everything it started end with the app.
         solidcraft_ui_egui::agent_chat::shutdown(&mut self.solve);
+        // A save still being written ends before the app does.
+        solidcraft_ui_egui::save_job::tick(&mut self.solve, true);
+        // Pictures still being drawn off the window thread (Home cards, file previews) end
+        // before the GPU is torn down: one drawn while the process exits can crash the driver.
+        if !solidcraft_engine::capture::close(std::time::Duration::from_secs(5)) {
+            log::warn!("a picture was still being drawn as the app closed");
+        }
         solidcraft_ui_egui::recovery_ui::close(&mut self.solve);
+        solidcraft_ui_egui::open_elsewhere::close(&mut self.solve);
         solidcraft_engine::crash::end_session();
+        if let Some(lost_at) = self.gpu.as_ref().and_then(|g| g.lost_at) {
+            device_lost::restart(self.gpu.as_ref().is_some_and(|g| g.restart_on_software), lost_at);
+        }
         // An update asked to restart into the new version or to run its installer.
         if let Some((program, args)) = solidcraft_ui_egui::update::take_launch(&mut self.solve) {
             let mut command = std::process::Command::new(&program);
@@ -112,6 +205,79 @@ impl eframe::App for App {
     }
 }
 
+/// The window's graphics device, watched for its loss.
+struct LostWatch {
+    lost: eframe::egui_wgpu::DeviceLost,
+    /// Where the next start runs once this device is lost ([`device_lost::restart_on_software`]).
+    restart_on_software: bool,
+    /// When the loss was seen: the app is closing to start again.
+    lost_at: Option<u64>,
+}
+
+impl App {
+    /// The graphics device was lost (#4172): the window can't draw again, so close, keeping
+    /// unsaved changes for recovery as a forced quit does (the window can't ask about them), and
+    /// start again once closed ([`device_lost::restart`]).
+    fn watch_device(&mut self) {
+        let Some(gpu) = self.gpu.as_mut().filter(|g| g.lost_at.is_none() && g.lost.is_lost()) else { return };
+        let reason = gpu.lost.reason().unwrap_or_default();
+        log::error!("graphics: the device was lost ({reason}); closing to start again");
+        eprintln!("SolidCraft graphics: the device was lost ({reason}); starting again");
+        solidcraft_engine::crash::phase(&format!("graphics device lost: {reason}"));
+        gpu.lost_at = Some(device_lost::now_secs());
+        self.solve.quit_requested = true;
+    }
+}
+
+/// Linux file dialogs match patterns by case, so each extension goes in as lower and upper
+/// case, plus FreeCAD's own mixed casing.
+fn case_variants(exts: &[&str]) -> Vec<String> {
+    let mut all: Vec<String> = Vec::new();
+    for e in exts {
+        let mut forms = vec![e.to_ascii_lowercase(), e.to_ascii_uppercase()];
+        if e.eq_ignore_ascii_case("fcstd") {
+            forms.push("FCStd".into());
+        }
+        for v in forms {
+            if !all.contains(&v) {
+                all.push(v);
+            }
+        }
+    }
+    all
+}
+
+/// egui's root Ui spans the whole viewport, including native safe areas. Lay out the app
+/// inside the unobscured rectangle so its application bar can receive native pointer input.
+fn content_ui(app: &mut SolveApp, ui: &mut egui::Ui) {
+    let content = ui.ctx().content_rect();
+    let above = egui::Rect::from_min_max(ui.max_rect().min, egui::pos2(ui.max_rect().right(), content.top()));
+    ui.painter().rect_filled(above, 0.0, solidcraft_ui_egui::theme::Tokens::get().app_bar);
+    ui.scope_builder(egui::UiBuilder::new().max_rect(content), |ui| app.ui(ui));
+}
+
+/// A transparent macOS title bar still intercepts clicks at the top in fullscreen (#3643).
+/// `contentLayoutRect` reports the whole content view once that bar auto-hides, so reserve
+/// the native titled-window height even then. AppKit supplies the height in logical points;
+/// egui's UI zoom is separate from the display's Retina scale.
+#[cfg(target_os = "macos")]
+fn macos_fullscreen_content(ctx: &egui::Context, raw: &mut egui::RawInput) {
+    let Some(mtm) = objc2::MainThreadMarker::new() else { return };
+    let frame = objc2_app_kit::NSWindow::frameRectForContentRect_styleMask(Default::default(), objc2_app_kit::NSWindowStyleMask::Titled, mtm);
+    fullscreen_content_insets(raw, frame.size.height as f32, ctx.zoom_factor());
+}
+
+#[cfg(any(target_os = "macos", test))]
+fn fullscreen_content_insets(raw: &mut egui::RawInput, title_height: f32, zoom: f32) {
+    let fullscreen = raw.viewports.get(&raw.viewport_id).and_then(|v| v.fullscreen).unwrap_or(false);
+    let mut insets = raw.safe_area_insets.unwrap_or_default();
+    if fullscreen && title_height.is_finite() && title_height > 0.0 && zoom.is_finite() && zoom > 0.0 {
+        insets.0.top = insets.0.top.max(title_height / zoom);
+    }
+    // Explicitly reset on leaving fullscreen: None would retain the preceding frame's inset.
+    raw.safe_area_insets = Some(insets);
+}
+
 fn services(cc: &eframe::CreationContext<'_>) -> Services {
     let parent = rfd::AsyncFileDialog::new().set_parent(cc);
     let open_parent = parent.clone();
@@ -123,48 +289,14 @@ fn services(cc: &eframe::CreationContext<'_>) -> Services {
             let mut dialog = open_parent.clone();
             if !first.is_empty() {
                 let label = first.iter().map(|e| e.to_uppercase()).collect::<Vec<_>>().join(", ");
-                let both: Vec<String> = first.iter().flat_map(|e| [e.to_lowercase(), e.to_uppercase()]).collect();
-                dialog = dialog.add_filter(label, &both);
+                dialog = dialog.add_filter(label, &case_variants(first));
             }
-            let future = dialog
-                .add_filter(
-                    "Designs, CAD files and meshes",
-                    &[
-                        io::DESIGN_EXT,
-                        io::LEGACY_DESIGN_EXT,
-                        "json",
-                        "step",
-                        "stp",
-                        "STEP",
-                        "STP",
-                        "igs",
-                        "iges",
-                        "IGS",
-                        "IGES",
-                        "FCStd",
-                        "fcstd",
-                        "3dm",
-                        "3DM",
-                        "3mf",
-                        "3MF",
-                        "stl",
-                        "STL",
-                        "obj",
-                        "OBJ",
-                        "glb",
-                        "GLB",
-                        "gltf",
-                        "GLTF",
-                    ],
-                )
-                .add_filter("SolidCraft design (container or JSON)", &[io::DESIGN_EXT, io::LEGACY_DESIGN_EXT, "json"])
-                .add_filter("STEP", &["step", "stp", "STEP", "STP"])
-                .add_filter("IGES", &["igs", "iges", "IGS", "IGES"])
-                .add_filter("FreeCAD and Rhino", &["FCStd", "fcstd", "3dm", "3DM"])
-                .add_filter("Mesh (3MF, STL, OBJ, glTF)", &["3mf", "3MF", "stl", "STL", "obj", "OBJ", "glb", "GLB", "gltf", "GLTF"])
-                .add_filter("Sketch drawings (DXF, SVG)", &["dxf", "DXF", "svg", "SVG"])
-                .add_filter("All files", &["*"])
-                .pick_file();
+            // The groups come from the format registry, so a new format joins this dialog by itself.
+            dialog = dialog.add_filter("Designs, CAD files and meshes", &case_variants(&io::formats::open_extensions(true)));
+            for (label, exts) in io::formats::import_filters(true) {
+                dialog = dialog.add_filter(label, &case_variants(&exts));
+            }
+            let future = dialog.add_filter("All files", &["*"]).pick_file();
             Box::pin(async move { future.await.map(|p| p.path().to_string_lossy().into_owned()) })
         })),
         // One kind of file (the agent chat's attachments): only the types it names, as given and in
@@ -179,7 +311,8 @@ fn services(cc: &eframe::CreationContext<'_>) -> Services {
                 }
             }
             let all: Vec<&str> = all.iter().map(String::as_str).collect();
-            let future = file_parent.clone().add_filter(label, &all).pick_file();
+            // Any other file attaches by reference, so the list is not the only choice.
+            let future = file_parent.clone().add_filter(label, &all).add_filter("All files", &["*"]).pick_file();
             Box::pin(async move { future.await.map(|p| p.path().to_string_lossy().into_owned()) })
         })),
         pick_program: Some(Box::new(move || {
@@ -202,11 +335,17 @@ fn services(cc: &eframe::CreationContext<'_>) -> Services {
             let future = dialog.save_file();
             Box::pin(async move { future.await.map(|p| p.path().to_string_lossy().into_owned()) })
         })),
+        graphics_adapters: Vec::new(),
         graphics_path: graphics_path().map(|p| p.to_string_lossy().to_string()),
+        window_system: window_system_now(),
         http_get: Some(std::sync::Arc::new(http_get)),
         http_download: Some(std::sync::Arc::new(http_download)),
         // Already an installed app: only the browser build offers to install.
         install_app: None,
+        can_restore: None,
+        restore_file: None,
+        download_design: None,
+        browser_files: None,
         agent_http: Some(std::sync::Arc::new(agent_http)),
         secrets: Some(std::sync::Arc::new(Keychain)),
         show_in_folder: Some(Box::new(|path| {
@@ -277,7 +416,7 @@ fn agent_http(r: &solidcraft_ui_egui::agent_chat::backend::HttpRequest) -> Resul
     let agent: ureq::Agent = ureq::Agent::config_builder()
         .tls_config(tls)
         .http_status_as_error(false)
-        .timeout_global(Some(Duration::from_secs(r.timeout_s.clamp(1, 900))))
+        .timeout_global(Some(Duration::from_secs(r.timeout_s.clamp(1, 3600))))
         .timeout_connect(Some(Duration::from_secs(10)))
         .user_agent("SolidCraft")
         .max_redirects(0)
@@ -368,14 +507,15 @@ fn http_call(url: &str, timeout: std::time::Duration) -> Result<ureq::http::Resp
 }
 
 /// The per-user settings folder: eframe's storage (`app.ron`) and the anti-aliasing preference.
-fn settings_dir() -> Option<std::path::PathBuf> {
-    eframe::storage_dir("SolidCraft")
+fn settings_dir() -> Result<Option<std::path::PathBuf>, String> {
+    let selected = std::env::var_os("SOLIDCRAFT_SETTINGS_DIR");
+    startup::settings_directory(selected.as_deref(), eframe::storage_dir("SolidCraft"))
 }
 
 /// The anti-aliasing preference, kept next to eframe's storage (it is needed before the
 /// window opens).
 fn graphics_path() -> Option<std::path::PathBuf> {
-    settings_dir().map(|d| d.join("graphics.json"))
+    settings_dir().ok().flatten().map(|d| d.join("graphics.json"))
 }
 
 /// Compatibility shim (docs/compatibility.md): on the first launch after the rename, copy the
@@ -385,7 +525,7 @@ fn graphics_path() -> Option<std::path::PathBuf> {
 /// old app id's `~/.var/app` folder; that copy comes first, as it is the newest. The old folders
 /// are never changed.
 fn adopt_legacy_settings() {
-    let (Some(current), Some(legacy)) = (settings_dir(), eframe::storage_dir("SolveCraft")) else { return };
+    let (Some(current), Some(legacy)) = (settings_dir().ok().flatten(), eframe::storage_dir("SolveCraft")) else { return };
     let legacy_eframe = eframe::storage_dir(solidcraft_engine::io::LEGACY_APP_ID);
     let old_flatpak = solidcraft_engine::io::legacy_flatpak_path(&current);
     if let Err(e) = adopt_settings(&current, old_flatpak.as_deref(), &legacy, legacy_eframe.as_deref()) {
@@ -424,6 +564,18 @@ fn backend_preference() -> Option<String> {
     graphics().and_then(|v| v.get("backend").and_then(serde_json::Value::as_str).map(str::to_string))
 }
 
+/// The viewport scene's sample count: the app's anti-aliasing (the window's pass is 1x), clamped
+/// by the backend's policy (OpenGL renders 1x, see `effective_msaa_samples`). A count the device
+/// cannot render with falls back to the supported default.
+fn scene_samples(backend: eframe::wgpu::Backend, samples: u32, supported: &[u32]) -> u32 {
+    let requested = eframe::egui_wgpu::effective_msaa_samples(backend, samples.max(1));
+    if requested <= 1 || supported.is_empty() || supported.contains(&requested) {
+        requested
+    } else {
+        supported.iter().copied().filter(|&n| n <= solidcraft_ui_egui::prefs::Prefs::default().msaa).max().unwrap_or(1)
+    }
+}
+
 /// Anti-aliasing samples from Preferences (4 when unset).
 fn msaa() -> u16 {
     graphics()
@@ -446,7 +598,8 @@ const FLOAT_DEPTH_BITS: u8 = 32;
 const STENCIL_BITS: u8 = 8;
 const MSAA: u16 = 4;
 
-fn app_viewport() -> Result<egui::ViewportBuilder, eframe::Error> {
+/// `custom_titlebar`: no OS decorations, the application bar is the title bar.
+fn app_viewport(custom_titlebar: bool) -> Result<egui::ViewportBuilder, eframe::Error> {
     // Let macOS use the bundle's layered icon; eframe's default bitmap would replace it.
     #[cfg(target_os = "macos")]
     let icon = egui::IconData::default();
@@ -459,7 +612,7 @@ fn app_viewport() -> Result<egui::ViewportBuilder, eframe::Error> {
         .with_inner_size([1600.0, 1000.0])
         .with_min_inner_size([960.0, 600.0])
         .with_drag_and_drop(true)
-        .with_decorations(!CUSTOM_TITLEBAR)
+        .with_decorations(!custom_titlebar)
         .with_fullsize_content_view(true)
         .with_titlebar_shown(false)
         .with_title_shown(false)
@@ -470,7 +623,14 @@ fn app_viewport() -> Result<egui::ViewportBuilder, eframe::Error> {
 const APP_ID: &str = solidcraft_engine::io::APP_ID;
 
 fn main() -> eframe::Result {
-    adopt_legacy_settings();
+    #[cfg(target_os = "macos")]
+    objc2_foundation::NSProcessInfo::processInfo().setProcessName(objc2_foundation::ns_string!("SolidCraft"));
+    mark("main");
+    // Validate before legacy adoption, crash markers or any user preference read.
+    let settings = settings_dir().map_err(|error| eframe::Error::AppCreation(error.into()))?;
+    if std::env::var_os("SOLIDCRAFT_SETTINGS_DIR").is_none() {
+        adopt_legacy_settings();
+    }
     let mut safe_mode = startup::env_on(std::env::var(startup::SAFE_MODE_ENV).ok().as_deref());
     let mut control_port: Option<u16> = solidcraft_engine::geom::env::var("CONTROL_PORT").and_then(|p| p.parse().ok());
     let mut files = Vec::new();
@@ -507,7 +667,6 @@ fn main() -> eframe::Result {
     }
     // Settings that don't read are moved aside; launches that never got a window are counted,
     // and after a few in a row this one starts in safe mode (docs/book/src/guide/troubleshooting.md).
-    let settings = settings_dir();
     let mut notes: Vec<String> = Vec::new();
     let mut failed_starts = 0;
     if let Some(dir) = &settings {
@@ -519,6 +678,11 @@ fn main() -> eframe::Result {
         notes.push(format!("The last {failed_starts} launches stopped before the window opened, so this one is in safe mode."));
     }
     let cpu_renderer = safe_mode || startup::cpu_renderer_env(std::env::var(startup::RENDERER_ENV).ok().as_deref());
+    // The launch before this one closed because its graphics device was lost (`App::watch_device`).
+    let after_loss = device_lost::recent(std::env::var(device_lost::LOST_ENV).ok().as_deref(), device_lost::now_secs());
+    if after_loss {
+        notes.push(device_lost::note(cpu_renderer));
+    }
     if safe_mode {
         notes.push("Safe mode: default settings (yours are kept for the next normal start), no recovery offer, software rendering.".into());
     }
@@ -540,13 +704,21 @@ fn main() -> eframe::Result {
     // module on Windows, and on every system the startup step the app was in.
     #[cfg(target_os = "windows")]
     native_crash::install();
+    // Windows with only OpenGL to start: the system title bar instead of ours (#2063).
+    let started = match &wgpu_options.wgpu_setup {
+        eframe::egui_wgpu::WgpuSetup::CreateNew(setup) => setup.instance_descriptor.backends,
+        _ => eframe::wgpu::Backends::all(),
+    };
+    let custom_titlebar = CUSTOM_TITLEBAR && !startup::system_title_bar(cfg!(target_os = "windows"), started);
     eframe::egui_wgpu::set_startup_hook(startup_step);
     solidcraft_engine::crash::phase("window");
     let options = eframe::NativeOptions {
-        viewport: app_viewport()?,
-        depth_buffer: depth_bits,
-        stencil_buffer: STENCIL_BITS,
-        multisampling: samples,
+        viewport: app_viewport(custom_titlebar)?,
+        // The window's pass (egui's) has no depth and one sample: the viewport draws its scene
+        // offscreen with its own depth and MSAA, then blits it, so the UI pass pays for neither.
+        depth_buffer: 0,
+        stencil_buffer: 0,
+        multisampling: 1,
         // Kept with the other settings, not in a folder named after the app id. Safe mode reads
         // and writes a scratch copy, leaving the user's settings as they were.
         persistence_path: if safe_mode {
@@ -563,12 +735,24 @@ fn main() -> eframe::Result {
     #[cfg(all(unix, not(target_os = "macos")))]
     let mut options = options;
     #[cfg(all(unix, not(target_os = "macos")))]
-    if prefer_x11(
-        std::env::var_os("DISPLAY").is_some(),
-        std::env::var_os("WAYLAND_DISPLAY").is_some(),
-        std::env::var("XDG_CURRENT_DESKTOP").ok().as_deref(),
-        solidcraft_engine::geom::env::var("WAYLAND").as_deref(),
-    ) {
+    let x11 = {
+        // SOLIDCRAFT_WAYLAND wins over Preferences › Graphics › Window system (#3083).
+        let environment = solidcraft_engine::geom::env::var("WAYLAND");
+        let preference = window_system_preference();
+        let wayland_override = environment.as_deref().or(window_system_override(preference.as_deref()));
+        let wayland_display = std::env::var_os("WAYLAND_DISPLAY").is_some();
+        let x11 = prefer_x11(
+            std::env::var_os("DISPLAY").is_some(),
+            wayland_display,
+            std::env::var("XDG_CURRENT_DESKTOP").ok().as_deref(),
+            wayland_override,
+        );
+        // Without a Wayland socket winit opens on X11 anyway.
+        let _ = WINDOW_SYSTEM.set(if x11 || !wayland_display { "x11" } else { "wayland" });
+        x11
+    };
+    #[cfg(all(unix, not(target_os = "macos")))]
+    if x11 {
         options.event_loop_builder = Some(Box::new(|b| {
             use winit::platform::x11::EventLoopBuilderExtX11;
             b.with_x11();
@@ -580,22 +764,31 @@ fn main() -> eframe::Result {
     let created = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
     let created_in_app = created.clone();
     let starting = settings.clone();
+    mark("run_native");
     let result = eframe::run_native(
         "SolidCraft",
         options,
         Box::new(move |cc| {
             created_in_app.store(true, std::sync::atomic::Ordering::SeqCst);
             solidcraft_engine::crash::phase("app setup");
-            solidcraft_ui_egui::fonts::setup_fonts(&cc.egui_ctx);
+            mark("window and device ready");
+            solidcraft_ui_egui::fonts::setup_bundled_fonts(&cc.egui_ctx);
+            solidcraft_ui_egui::fonts::load_system_fonts_in_background(&cc.egui_ctx);
+            mark("fonts");
             let mut app = SolveApp::new(Session::default(), services(cc));
             app.apply_off_thread = Some(solidcraft_ui_egui::dialogs::APPLY_AT_ONCE);
-            app.custom_titlebar = CUSTOM_TITLEBAR;
-            // Windows: the OS hit test offers the resize border, at the window's DPI, from the
-            // first message (#1381).
+            app.custom_titlebar = custom_titlebar;
             #[cfg(target_os = "windows")]
             {
-                app.native_resize_border = CUSTOM_TITLEBAR && native_frame::install(cc);
-                if CUSTOM_TITLEBAR && !app.native_resize_border {
+                // Windows: the taskbar button shows the mark even when slow first frames keep the
+                // taskbar waiting for the window's icon.
+                if !native_frame::set_class_icon(cc) {
+                    eprintln!("SolidCraft window: no class icon; the taskbar may show a generic one");
+                }
+                // The OS hit test offers the resize border, at the window's DPI, from the first
+                // message (#1381).
+                app.native_resize_border = custom_titlebar && native_frame::install(cc);
+                if custom_titlebar && !app.native_resize_border {
                     eprintln!("SolidCraft window: no native resize border; egui edge zones instead");
                 }
             }
@@ -604,10 +797,29 @@ fn main() -> eframe::Result {
             if let Some(p) = cc.storage.and_then(|s| solidcraft_ui_egui::prefs::stored(|k| s.get_string(k))).filter(|_| !safe_mode) {
                 app.load_prefs(&p);
             }
+            mark("app state and prefs");
+            let gpu = cc.wgpu_render_state.as_ref().map(|rs| LostWatch {
+                lost: rs.device_lost.clone(),
+                restart_on_software: device_lost::restart_on_software(after_loss, cpu_renderer),
+                lost_at: None,
+            });
+            if !safe_mode {
+                app.preferences.graphics_adapter =
+                    graphics().and_then(|v| v.get("adapter").and_then(serde_json::Value::as_str).map(str::to_string)).unwrap_or_default();
+            }
             if let Some(rs) = &cc.wgpu_render_state {
-                eprintln!("SolidCraft graphics: {:?}, MSAA {}x (requested {}x)", rs.adapter.get_info().backend, rs.msaa_samples, samples);
+                app.services.graphics_adapters = rs
+                    .available_adapters
+                    .iter()
+                    .map(|adapter| {
+                        let info = adapter.get_info();
+                        (info.name.clone(), format!("{} ({:?}, {:?})", info.name, info.device_type, info.backend))
+                    })
+                    .collect();
+                let scene_samples = scene_samples(rs.adapter.get_info().backend, u32::from(samples), &rs.msaa_supported);
+                eprintln!("SolidCraft graphics: {:?}, MSAA {scene_samples}x (requested {}x)", rs.adapter.get_info().backend, samples);
                 solidcraft_engine::crash::phase("viewport pipelines (shader compile)");
-                app.set_wgpu(rs, depth_bits, STENCIL_BITS, rs.msaa_samples);
+                app.set_wgpu_split(rs, depth_bits, STENCIL_BITS, scene_samples);
                 solidcraft_ui_egui::gpu::install_picture_renderer(rs);
                 // The graphics driver is loaded now; it may have put its own exception filter
                 // in front of ours.
@@ -617,12 +829,15 @@ fn main() -> eframe::Result {
                 solidcraft_ui_egui::prefs::check_msaa(&mut app, u32::from(samples));
                 let info = rs.adapter.get_info();
                 solidcraft_engine::crash::set_environment(&format!(
-                    "Renderer: {:?} {} ({}), MSAA {}x",
-                    info.backend, info.name, info.driver, rs.msaa_samples
+                    "Renderer: {:?} {} ({}), MSAA {scene_samples}x",
+                    info.backend, info.name, info.driver
                 ));
             }
-            if let Some(port) = control_port {
-                let rx = control_server::start(port, cc.egui_ctx.clone());
+            mark("viewport pipelines");
+            // `--control`/the environment name a port; otherwise the preference (on by default)
+            // opens the default one (docs/control-protocol.md).
+            if let Some(listen_on) = solidcraft_engine::control_auth::plan(control_port, app.preferences.agent_control) {
+                let rx = control_server::start(listen_on, cc.egui_ctx.clone());
                 app = app.with_control(rx);
             }
             // The agent chat's MCP bridge reaches the app through an endpoint of its own, started
@@ -637,6 +852,9 @@ fn main() -> eframe::Result {
                 app.session.mark_saved();
                 app.session.undo.clear();
             }
+            // Lock files next to open designs: a design open on another computer says so (#5467),
+            // the files given at launch included.
+            solidcraft_ui_egui::open_elsewhere::start(&mut app);
             // A launch from Finder: its files arrived before the window.
             #[cfg(target_os = "macos")]
             let files = {
@@ -673,13 +891,30 @@ fn main() -> eframe::Result {
             }
             #[cfg(any(target_os = "windows", target_os = "linux", target_os = "macos"))]
             let space_mouse = space_mouse::SpaceMouse::start(&cc.egui_ctx);
+            #[cfg(target_os = "macos")]
+            let native_menu = match native_menu::NativeMenu::new(&app, &cc.egui_ctx) {
+                Ok(menu) => Some(menu),
+                Err(error) => {
+                    app.set_status(format!("System menu: {error}"), true);
+                    None
+                }
+            };
+            #[cfg(target_os = "macos")]
+            {
+                app.native_file_menu = native_menu.is_some();
+            }
+            mark("app created");
             solidcraft_engine::crash::phase("first frame");
             Ok(Box::new(App {
                 solve: app,
                 starting,
                 frames: 0,
+                take_focus_unwanted: control_port.is_some(),
+                gpu,
                 #[cfg(any(target_os = "windows", target_os = "linux", target_os = "macos"))]
                 space_mouse,
+                #[cfg(target_os = "macos")]
+                native_menu,
             }))
         }),
     );
@@ -710,9 +945,12 @@ fn wgpu_options(cpu: bool, preference: Option<&str>) -> eframe::egui_wgpu::WgpuC
             eprintln!("SolidCraft graphics: starting {backends:?}");
             setup.instance_descriptor.backends = backends;
         }
-        if cpu {
-            setup.native_adapter_selector = Some(std::sync::Arc::new(startup::pick_cpu_adapter));
-        }
+        let intel_mac = cfg!(all(target_os = "macos", target_arch = "x86_64"));
+        let indirect = std::env::var(startup::INDIRECT_VALIDATION_ENV).ok();
+        setup.instance_descriptor.flags = startup::window_instance_flags(setup.instance_descriptor.flags, intel_mac, indirect.as_deref());
+        let environment = std::env::var("WGPU_ADAPTER_NAME").ok();
+        let adapter = graphics().and_then(|v| v.get("adapter").and_then(serde_json::Value::as_str).map(str::to_string));
+        startup::configure_adapter(setup, cpu, environment, adapter);
         // A float depth buffer with a stencil, wherever the adapter has it (see `FLOAT_DEPTH_BITS`).
         let base = setup.device_descriptor.clone();
         setup.device_descriptor = std::sync::Arc::new(move |adapter| {
@@ -747,6 +985,36 @@ fn no_window(error: eframe::Error, tried_cpu: bool, settings: Option<&std::path:
     Err(error)
 }
 
+/// Linux: the window system this run opened with (`wayland` or `x11`), for Preferences (#3083).
+#[cfg(all(unix, not(target_os = "macos")))]
+static WINDOW_SYSTEM: std::sync::OnceLock<&'static str> = std::sync::OnceLock::new();
+
+/// The window system this run uses, where there is a choice (Linux).
+fn window_system_now() -> Option<&'static str> {
+    #[cfg(all(unix, not(target_os = "macos")))]
+    return WINDOW_SYSTEM.get().copied();
+    #[cfg(not(all(unix, not(target_os = "macos"))))]
+    None
+}
+
+/// Preferences › Graphics › Window system (`graphics.json`'s `window_system`), read before the
+/// window opens.
+#[cfg(all(unix, not(target_os = "macos")))]
+fn window_system_preference() -> Option<String> {
+    graphics().and_then(|v| v.get("window_system").and_then(serde_json::Value::as_str).map(str::to_string))
+}
+
+/// The window system preference as the `SOLIDCRAFT_WAYLAND` value it stands for: `wayland` is
+/// `1`, `x11` is `0`, and `auto` (or anything else) leaves the choice to [`prefer_x11`].
+#[cfg(all(unix, not(target_os = "macos")))]
+fn window_system_override(preference: Option<&str>) -> Option<&'static str> {
+    match preference.map(str::trim) {
+        Some("wayland") => Some("1"),
+        Some("x11") => Some("0"),
+        _ => None,
+    }
+}
+
 /// Whether to run through XWayland rather than native Wayland. winit has no file drag-and-drop
 /// on Wayland (only on X11), so dropping files from the file manager showed a "no" cursor: use
 /// XWayland when it's there. Except on niri, whose XWayland (xwayland-satellite) breaks window
@@ -784,14 +1052,27 @@ mod backend_tests {
         assert!(prefer_x11(true, true, Some("niri"), Some("0")));
         assert!(!prefer_x11(false, true, Some("niri"), Some("0")));
     }
+
+    /// Preferences › Graphics › Window system stands for the same values (#3083).
+    #[test]
+    fn the_window_system_preference_maps_to_the_override() {
+        use super::window_system_override as over;
+        assert_eq!(
+            (over(Some("wayland")), over(Some("x11")), over(Some("auto")), over(None), over(Some("junk"))),
+            (Some("1"), Some("0"), None, None, None)
+        );
+        // Wayland chosen on GNOME keeps native Wayland; X11 chosen on niri goes through XWayland.
+        assert!(!prefer_x11(true, true, Some("GNOME"), over(Some("wayland"))));
+        assert!(prefer_x11(true, true, Some("niri"), over(Some("x11"))));
+    }
 }
 
 #[cfg(test)]
-mod icon_tests {
+mod viewport_tests {
     #[cfg(target_os = "macos")]
     #[test]
     fn macos_preserves_the_bundle_icon_instead_of_setting_a_runtime_bitmap() {
-        let viewport = super::app_viewport().expect("viewport");
+        let viewport = super::app_viewport(super::CUSTOM_TITLEBAR).expect("viewport");
         assert_eq!(viewport.icon.as_deref(), Some(&eframe::egui::IconData::default()));
         assert_eq!(viewport.app_id.as_deref(), Some(super::APP_ID));
     }
@@ -799,12 +1080,89 @@ mod icon_tests {
     #[cfg(not(target_os = "macos"))]
     #[test]
     fn desktop_viewport_supplies_the_original_mark_to_the_window() {
-        let viewport = super::app_viewport().expect("viewport");
+        let viewport = super::app_viewport(super::CUSTOM_TITLEBAR).expect("viewport");
         let icon = viewport.icon.expect("running window must have an icon");
         assert_eq!((icon.width, icon.height), (64, 64));
         assert_eq!(icon.rgba, super::app_icon::rgba(64).expect("original mark"));
         assert_eq!(viewport.app_id.as_deref(), Some(super::APP_ID));
     }
+
+    #[test]
+    fn fullscreen_bar_clears_native_chrome_and_undo_redo_keep_working() {
+        use egui::{Event, PointerButton, Pos2, RawInput, Rect, ViewportId, vec2};
+        use serde_json::json;
+        use solidcraft_ui_egui::scenario::handle_at;
+
+        // AppKit points are independent of Retina scale and of the user's UI zoom.
+        for (zoom, retina) in [(1.0, 1.0), (1.0, 2.0), (1.5, 2.0), (2.0, 2.0)] {
+            let ctx = egui::Context::default();
+            solidcraft_ui_egui::fonts::setup_bundled_fonts(&ctx);
+            ctx.set_zoom_factor(zoom);
+            let mut app = super::SolveApp::new(super::Session::default(), Default::default());
+            app.integrated_titlebar = true;
+            for (command, params) in [
+                ("sketch.create", json!({"plane":"XY"})),
+                ("sketch.rectangle.two_point", json!({"p0":[0,0],"p1":[40,30]})),
+                ("sketch.finish", json!({})),
+                ("solid.extrude", json!({"distance":15})),
+            ] {
+                app.run(command, params).unwrap();
+            }
+            let mut time = 0.0;
+            let mut frame = |app: &mut super::SolveApp, fullscreen, events| {
+                time += 0.05;
+                let mut raw = RawInput {
+                    screen_rect: Some(Rect::from_min_size(Pos2::ZERO, vec2(1600.0, 1000.0))),
+                    time: Some(time),
+                    events,
+                    ..Default::default()
+                };
+                let viewport = raw.viewports.get_mut(&ViewportId::ROOT).unwrap();
+                viewport.fullscreen = Some(fullscreen);
+                viewport.native_pixels_per_point = Some(retina);
+                super::fullscreen_content_insets(&mut raw, 32.0, zoom);
+                let _ = ctx.run_ui(raw, |ui| super::content_ui(app, ui));
+            };
+            // Enter, leave, and enter again: no stale inset when returning to a normal window.
+            for fullscreen in [false, true, false, true] {
+                frame(&mut app, fullscreen, vec![]);
+                frame(&mut app, fullscreen, vec![]);
+                let top = if fullscreen { 32.0 / zoom } else { 0.0 };
+                for name in ["appbar:file", "appbar:undo", "appbar:redo", "appbar:help"] {
+                    let at = handle_at(name).unwrap();
+                    assert!((at.y - top - 17.0).abs() < 0.1, "{name}: {at:?}, fullscreen={fullscreen}, zoom={zoom}");
+                }
+                for (handle, bodies) in [("appbar:undo", 0), ("appbar:redo", 1)] {
+                    let at = handle_at(handle).unwrap();
+                    frame(&mut app, fullscreen, vec![Event::PointerMoved(at)]);
+                    for pressed in [true, false] {
+                        frame(
+                            &mut app,
+                            fullscreen,
+                            vec![Event::PointerButton { pos: at, button: PointerButton::Primary, pressed, modifiers: Default::default() }],
+                        );
+                    }
+                    assert_eq!(app.session.model.state().bodies.len(), bodies, "{handle}, fullscreen={fullscreen}, zoom={zoom}");
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn fullscreen_inset_preserves_existing_safe_areas_and_resets_on_exit() {
+        use egui::epaint::MarginF32;
+        use egui::{RawInput, SafeAreaInsets, ViewportId};
+        let mut raw = RawInput::default();
+        raw.viewports.get_mut(&ViewportId::ROOT).unwrap().fullscreen = Some(true);
+        raw.safe_area_insets = Some(SafeAreaInsets(MarginF32 { top: 40.0, left: 5.0, right: 6.0, bottom: 7.0 }));
+        super::fullscreen_content_insets(&mut raw, 32.0, 2.0);
+        assert_eq!(raw.safe_area_insets.unwrap().0, MarginF32 { top: 40.0, left: 5.0, right: 6.0, bottom: 7.0 });
+
+        raw.viewports.get_mut(&ViewportId::ROOT).unwrap().fullscreen = Some(false);
+        raw.safe_area_insets = None;
+        super::fullscreen_content_insets(&mut raw, 32.0, 1.0);
+        assert_eq!(raw.safe_area_insets, Some(SafeAreaInsets::default()));
+    }
 }
 
 #[cfg(test)]
@@ -841,4 +1199,13 @@ mod msaa_tests {
             }
         }
     }
+
+    #[test]
+    fn the_scene_follows_the_backend_policy_too() {
+        use eframe::wgpu::Backend;
+        assert_eq!(super::scene_samples(Backend::Gl, 4, &[1, 4]), 1);
+        assert_eq!(super::scene_samples(Backend::Gl, 4, &[]), 1);
+        assert_eq!(super::scene_samples(Backend::Vulkan, 4, &[1, 4]), 4);
+        assert_eq!(super::scene_samples(Backend::Dx12, 8, &[1, 2, 4]), 4);
+    }
 }

apps/solidcraft/src/native_frame.rs

@@ -15,10 +15,14 @@
 //! window rescales once at the crossing and stays under the pointer, instead of the OS's move
 //! loop and winit disagreeing about a frame the window doesn't have.
 //!
-//! Replacing a window procedure has no safe API, hence the `unsafe_code` allowance on this
-//! module (the app crate denies it; see `native_crash.rs` and `open_documents.rs` for the others).
+//! Replacing a window procedure and setting a window class's icon have no safe API, hence the
+//! `unsafe_code` allowance on this module (the app crate denies it; see `native_crash.rs` and
+//! `open_documents.rs` for the others).
 //! The procedure is installed once, on the thread that owns the window, for the main window only,
 //! and calls the previous one (winit's) for everything it doesn't answer.
+//!
+//! [`set_class_icon`] gives the window's class the exe's icon, so the taskbar button shows the
+//! mark even when the window is too busy to answer the taskbar's request for its icon.
 #![allow(unsafe_code)]
 
 use std::sync::atomic::{AtomicIsize, Ordering};
@@ -26,12 +30,81 @@ use std::sync::atomic::{AtomicIsize, Ordering};
 use raw_window_handle::{HasWindowHandle, RawWindowHandle};
 use solidcraft_ui_egui::titlebar;
 use windows_sys::Win32::Foundation::{HWND, LPARAM, LRESULT, RECT, SIZE, WPARAM};
+use windows_sys::Win32::Graphics::Gdi::{GetMonitorInfoW, MONITOR_DEFAULTTONEAREST, MONITORINFO, MonitorFromWindow};
+use windows_sys::Win32::System::LibraryLoader::GetModuleHandleW;
 use windows_sys::Win32::UI::HiDpi::{GetDpiForWindow, GetSystemMetricsForDpi};
 use windows_sys::Win32::UI::WindowsAndMessaging::{
-    CallWindowProcW, GWL_STYLE, GWLP_WNDPROC, GetClientRect, GetWindowLongPtrW, GetWindowRect, HTBOTTOM, HTBOTTOMLEFT, HTBOTTOMRIGHT, HTLEFT,
-    HTRIGHT, HTTOP, HTTOPLEFT, HTTOPRIGHT, IsIconic, IsZoomed, SM_CXPADDEDBORDER, SM_CXSIZEFRAME, SetWindowLongPtrW, WM_GETDPISCALEDSIZE,
-    WM_NCDESTROY, WM_NCHITTEST, WNDPROC, WS_THICKFRAME,
+    CallWindowProcW, GCLP_HICON, GCLP_HICONSM, GWL_STYLE, GWLP_WNDPROC, GetClientRect, GetWindowLongPtrW, GetWindowRect, HTBOTTOM, HTBOTTOMLEFT,
+    HTBOTTOMRIGHT, HTLEFT, HTRIGHT, HTTOP, HTTOPLEFT, HTTOPRIGHT, IMAGE_ICON, IsIconic, IsZoomed, LR_DEFAULTCOLOR, LoadImageW, SM_CXICON,
+    SM_CXPADDEDBORDER, SM_CXSIZEFRAME, SM_CXSMICON, SetWindowLongPtrW, WM_GETDPISCALEDSIZE, WM_NCDESTROY, WM_NCHITTEST, WNDPROC, WS_THICKFRAME,
 };
+// windows-sys has SetClassLongPtrW only on 64-bit targets; on 32-bit Windows it is SetClassLongW.
+#[cfg(target_pointer_width = "64")]
+use windows_sys::Win32::UI::WindowsAndMessaging::SetClassLongPtrW;
+#[cfg(target_pointer_width = "32")]
+use windows_sys::Win32::UI::WindowsAndMessaging::SetClassLongW as SetClassLongPtrW;
+
+/// The work area (the monitor without the taskbar) of the monitor nearest the window, in physical
+/// pixels: left, top, width, height.
+pub fn work_area(window: &impl HasWindowHandle) -> Option<(i32, i32, i32, i32)> {
+    let handle = window.window_handle().ok()?;
+    let RawWindowHandle::Win32(w) = handle.as_raw() else { return None };
+    let hwnd = w.hwnd.get() as HWND;
+    // SAFETY: `hwnd` is the live main window; `info` is a MONITORINFO with its size set, as
+    // GetMonitorInfoW requires, and the monitor handle comes from the call before it.
+    let rc = unsafe {
+        let monitor = MonitorFromWindow(hwnd, MONITOR_DEFAULTTONEAREST);
+        let mut info: MONITORINFO = std::mem::zeroed();
+        info.cbSize = std::mem::size_of::<MONITORINFO>() as u32;
+        if monitor.is_null() || GetMonitorInfoW(monitor, &mut info) == 0 {
+            return None;
+        }
+        info.rcWork
+    };
+    Some((rc.left, rc.top, rc.right - rc.left, rc.bottom - rc.top))
+}
+
+/// The exe's icon resource (`build.rs` embeds it as `1 ICON`).
+const ICON_RESOURCE: usize = 1;
+
+/// Give the main window's class the exe's icon, big and small. Call it before the window is
+/// shown (eframe's app creator).
+///
+/// The taskbar asks a window for its icon when the window appears. eframe sets the window's
+/// icon before that, while the window is still hidden, and then shows the window at the end of
+/// its first frame; if that frame is slow, or startup kept the thread busy long enough for
+/// Windows to mark the window as not responding, the request isn't answered in time. The taskbar then
+/// takes the window class's icon and doesn't ask again. winit registers its class without one,
+/// so the button showed Windows' generic icon for as long as the window was open.
+/// `false` if it isn't a Win32 window or the exe's icon doesn't load; SetClassLongPtrW's own
+/// failure can't be told from a class that had no icon (both return 0), so it isn't reported.
+pub fn set_class_icon(window: &impl HasWindowHandle) -> bool {
+    let Ok(handle) = window.window_handle() else { return false };
+    let RawWindowHandle::Win32(w) = handle.as_raw() else { return false };
+    let hwnd = w.hwnd.get() as HWND;
+    // SAFETY: a plain query on the live main window.
+    let dpi = unsafe { GetDpiForWindow(hwnd) };
+    let (Some(big), Some(small)) = (exe_icon(SM_CXICON, dpi), exe_icon(SM_CXSMICON, dpi)) else { return false };
+    // SAFETY: `hwnd` is the live main window and both icons are valid handles. The class keeps
+    // them for the rest of the process, so they are never destroyed. `as _`: on 32-bit Windows
+    // this is SetClassLongW (see the imports), which takes an i32.
+    unsafe {
+        SetClassLongPtrW(hwnd, GCLP_HICON, big as _);
+        SetClassLongPtrW(hwnd, GCLP_HICONSM, small as _);
+    }
+    true
+}
+
+/// The exe's icon at the size of system metric `metric` (`SM_CXICON`, `SM_CXSMICON`) at `dpi`.
+fn exe_icon(metric: i32, dpi: u32) -> Option<windows_sys::Win32::Foundation::HANDLE> {
+    // SAFETY: GetModuleHandleW(null) is this exe, loaded for the life of the process; the name
+    // is an integer resource id (MAKEINTRESOURCE), which LoadImageW accepts in place of a string.
+    let icon = unsafe {
+        let size = GetSystemMetricsForDpi(metric, dpi);
+        LoadImageW(GetModuleHandleW(std::ptr::null()), std::ptr::without_provenance(ICON_RESOURCE), IMAGE_ICON, size, size, LR_DEFAULTCOLOR)
+    };
+    (!icon.is_null()).then_some(icon)
+}
 
 /// The window procedure ours replaced (winit's), as an address; 0 before [`install`].
 static PREVIOUS: AtomicIsize = AtomicIsize::new(0);

apps/solidcraft/src/native_menu.rs

@@ -0,0 +1,190 @@
+//! macOS system menus, owned and updated on eframe's main thread.
+
+use std::sync::mpsc::{Receiver, sync_channel};
+
+use muda::{
+    AboutMetadata, Menu, MenuEvent, MenuItem, PredefinedMenuItem, Submenu,
+    accelerator::{Accelerator, Code, Modifiers},
+};
+use solidcraft_ui_egui::{SolveApp, toolbar::FileAction};
+
+pub struct NativeMenu {
+    menu: Menu,
+    actions: Vec<(MenuItem, FileAction)>,
+    help_actions: Vec<(MenuItem, &'static str)>,
+    events: Receiver<MenuEvent>,
+    recent: Submenu,
+    recent_paths: Vec<String>,
+}
+
+impl NativeMenu {
+    pub fn new(app: &SolveApp, ctx: &egui::Context) -> muda::Result<Self> {
+        let menu = Menu::new();
+        let application = Submenu::new("SolidCraft", true);
+        let file = Submenu::new(app.tr("ui.file"), true);
+        let edit = Submenu::new(app.tr_label("Edit"), true);
+        let recent = Submenu::new(app.tr("ui.open_recent"), true);
+        let window = Submenu::new("Window", true);
+        let help = Submenu::new(app.tr("ui.help"), true);
+        let mut help_actions = Vec::new();
+        let mut actions = Vec::new();
+        let mut add = |parent: &Submenu, label: &str, action: FileAction, shortcut: Option<Accelerator>| -> muda::Result<()> {
+            let item = MenuItem::new(label, Self::action_enabled(&action, app, ctx), shortcut);
+            parent.append(&item)?;
+            actions.push((item, action));
+            Ok(())
+        };
+        application.append(&PredefinedMenuItem::about(
+            Some("About SolidCraft"),
+            Some(AboutMetadata { name: Some("SolidCraft".into()), version: Some(env!("CARGO_PKG_VERSION").into()), ..Default::default() }),
+        ))?;
+        application.append(&PredefinedMenuItem::separator())?;
+        add(
+            &application,
+            &format!("{}\u{2026}", app.tr("ui.preferences")),
+            FileAction::Settings,
+            Some(Accelerator::new(Modifiers::META, Code::Comma)),
+        )?;
+        add(&application, &format!("{}\u{2026}", app.tr("ui.keyboard_shortcuts")), FileAction::Shortcuts, None)?;
+        application.append(&PredefinedMenuItem::separator())?;
+        application.append(&PredefinedMenuItem::services(None))?;
+        application.append(&PredefinedMenuItem::separator())?;
+        application.append_items(&[
+            &PredefinedMenuItem::hide(Some("Hide SolidCraft")),
+            &PredefinedMenuItem::hide_others(None),
+            &PredefinedMenuItem::show_all(None),
+            &PredefinedMenuItem::separator(),
+        ])?;
+        add(&application, &format!("{} SolidCraft", app.tr("ui.quit")), FileAction::Quit, Some(Accelerator::new(Modifiers::META, Code::KeyQ)))?;
+        add(&file, app.tr("ui.new_design"), FileAction::New, Some(Accelerator::new(Modifiers::META, Code::KeyN)))?;
+        add(&file, &format!("{}\u{2026}", app.tr("ui.open")), FileAction::Open, Some(Accelerator::new(Modifiers::META, Code::KeyO)))?;
+        file.append(&recent)?;
+        file.append(&PredefinedMenuItem::separator())?;
+        for (label, command) in
+            [("Insert STEP\u{2026}", "file.insert_step"), ("Insert Mesh\u{2026}", "file.insert_mesh"), ("Insert Design", "component.insert_design")]
+        {
+            add(&file, app.tr_label(label), FileAction::Command(command), None)?;
+        }
+        file.append(&PredefinedMenuItem::separator())?;
+        add(&file, app.tr("ui.save"), FileAction::Save, Some(Accelerator::new(Modifiers::META, Code::KeyS)))?;
+        add(
+            &file,
+            &format!("{}\u{2026}", app.tr("ui.save_as")),
+            FileAction::SaveAs,
+            Some(Accelerator::new(Modifiers::META | Modifiers::SHIFT, Code::KeyS)),
+        )?;
+        add(&file, app.tr_label("Save As JSON\u{2026}"), FileAction::SaveJson, None)?;
+        file.append(&PredefinedMenuItem::separator())?;
+        for (label, action) in [
+            ("Export STL\u{2026}", FileAction::ExportMesh("stl")),
+            ("Export 3MF\u{2026}", FileAction::ExportMesh("3mf")),
+            ("Export STEP\u{2026}", FileAction::Export("step")),
+            ("Export Current View as DXF\u{2026}", FileAction::Command("file.export_view_dxf")),
+            ("Export OBJ\u{2026}", FileAction::Export("obj")),
+            ("Export URDF\u{2026}", FileAction::Export("urdf")),
+            ("Export Design as JSON\u{2026}", FileAction::Export("json")),
+        ] {
+            add(&file, app.tr_label(label), action, None)?;
+        }
+        file.append(&PredefinedMenuItem::separator())?;
+        add(&file, app.tr_label("Design Properties"), FileAction::Command("document.metadata"), None)?;
+        add(&edit, app.tr("ui.undo"), FileAction::Undo, Some(Accelerator::new(Modifiers::META, Code::KeyZ)))?;
+        add(&edit, app.tr("ui.redo"), FileAction::Redo, Some(Accelerator::new(Modifiers::META | Modifiers::SHIFT, Code::KeyZ)))?;
+        add(&window, app.tr_label("Agent Chat"), FileAction::AgentChat, None)?;
+        window.append(&PredefinedMenuItem::separator())?;
+        window.append_items(&[
+            &PredefinedMenuItem::minimize(None),
+            &PredefinedMenuItem::maximize(None),
+            &PredefinedMenuItem::fullscreen(None),
+            &PredefinedMenuItem::separator(),
+            &PredefinedMenuItem::bring_all_to_front(None),
+        ])?;
+        for (action, label) in [
+            ("docs", "Documentation"),
+            ("shortcuts", "Keyboard Shortcuts"),
+            ("messages", "Messages\u{2026}"),
+            ("report", "Report an Issue\u{2026}"),
+            ("crashes", "Crash Reports\u{2026}"),
+            ("install_cli", "Install solidcraft-cli command"),
+        ] {
+            let item = MenuItem::new(app.tr_label(label), true, None);
+            help.append(&item)?;
+            help_actions.push((item, action));
+        }
+        menu.append_items(&[&application, &file, &edit, &window, &help])?;
+        let (sender, events) = sync_channel(64);
+        let ctx = ctx.clone();
+        MenuEvent::set_event_handler(Some(move |event| {
+            let _ = sender.try_send(event);
+            ctx.request_repaint();
+        }));
+        menu.init_for_nsapp();
+        let mut native = Self { menu, actions, help_actions, events, recent, recent_paths: Vec::new() };
+        native.update_recent(app)?;
+        Ok(native)
+    }
+
+    pub fn raw_input_hook(&mut self, app: &mut SolveApp, ctx: &egui::Context, raw: &mut egui::RawInput) {
+        for event in self.events.try_iter().take(64) {
+            if let Some((_, action)) = self.help_actions.iter().find(|(item, _)| item.id() == &event.id) {
+                solidcraft_ui_egui::help::run(app, ctx, action);
+            }
+            if let Some((_, action)) = self.actions.iter().find(|(item, _)| item.id() == &event.id) {
+                if matches!(action, FileAction::Undo | FileAction::Redo) && ctx.egui_wants_keyboard_input() {
+                    raw.events.push(egui::Event::Key {
+                        key: egui::Key::Z,
+                        physical_key: None,
+                        pressed: true,
+                        repeat: false,
+                        modifiers: egui::Modifiers { command: true, mac_cmd: true, shift: matches!(action, FileAction::Redo), ..Default::default() },
+                    });
+                } else {
+                    action.run(app);
+                }
+            }
+        }
+    }
+
+    fn action_enabled(action: &FileAction, app: &SolveApp, ctx: &egui::Context) -> bool {
+        action.enabled(app)
+            || (matches!(action, FileAction::Undo | FileAction::Redo) && ctx.egui_wants_keyboard_input() && FileAction::Settings.enabled(app))
+    }
+
+    pub fn tick(&mut self, app: &mut SolveApp, ctx: &egui::Context) {
+        for (item, action) in &self.actions {
+            let enabled = Self::action_enabled(action, app, ctx);
+            if item.is_enabled() != enabled {
+                item.set_enabled(enabled);
+            }
+        }
+        if !self.recent_paths.iter().eq(app.home.recent.iter().take(32))
+            && let Err(error) = self.update_recent(app)
+        {
+            app.set_status(format!("Recent designs menu: {error}"), true);
+        }
+    }
+
+    fn update_recent(&mut self, app: &SolveApp) -> muda::Result<()> {
+        while self.recent.remove_at(0).is_some() {}
+        self.actions.retain(|(_, action)| !matches!(action, FileAction::OpenRecent(_) | FileAction::ClearRecent));
+        self.recent_paths = app.home.recent.iter().take(32).cloned().collect();
+        for path in &self.recent_paths {
+            let action = FileAction::OpenRecent(path.clone());
+            let item = MenuItem::new(path, action.enabled(app), None);
+            self.recent.append(&item)?;
+            self.actions.push((item, action));
+        }
+        self.recent.append(&PredefinedMenuItem::separator())?;
+        let clear = MenuItem::new(app.tr("ui.clear_recent"), !self.recent_paths.is_empty(), None);
+        self.recent.append(&clear)?;
+        self.actions.push((clear, FileAction::ClearRecent));
+        Ok(())
+    }
+}
+
+impl Drop for NativeMenu {
+    fn drop(&mut self) {
+        MenuEvent::set_event_handler(None::<fn(MenuEvent)>);
+        self.menu.remove_for_nsapp();
+    }
+}

apps/solidcraft/src/space_mouse/hidraw.rs

@@ -1,17 +1,35 @@
 //! Finding a 3D mouse on Linux. The kernel exposes every HID interface as `/dev/hidrawN`, with
-//! its report descriptor under `/sys/class/hidraw/hidrawN/device/`. Reading it is plain file
-//! I/O, so no udev or hidapi library is needed.
+//! its report descriptor and ids under `/sys/class/hidraw/hidrawN/device/`. Reading them is plain
+//! file I/O, so no udev or hidapi library is needed.
 
+use std::io::Read;
 use std::path::{Path, PathBuf};
+use std::time::Duration;
 
 use solidcraft_space_mouse::{Descriptor, Layout};
 
 const SYSFS: &str = "/sys/class/hidraw";
 const DEV: &str = "/dev";
 
+/// `O_NONBLOCK` on Linux's common architectures (x86, ARM, RISC-V). The device is opened with it so
+/// a read with nothing to read returns at once and the reader can see whether it should stop.
+pub const O_NONBLOCK: i32 = 0o4000;
+
+/// Opens a hidraw node the way the Direct reader reads it: read-only and non-blocking.
+pub fn open(path: &Path) -> std::io::Result<std::fs::File> {
+    use std::os::unix::fs::OpenOptionsExt;
+    std::fs::OpenOptions::new().read(true).custom_flags(O_NONBLOCK).open(path)
+}
+
+/// How long the reader waits when the device has nothing to say, which is also the most a report
+/// can be delayed.
+const IDLE_POLL: Duration = Duration::from_millis(5);
+
 pub struct Device {
     pub path: PathBuf,
     pub layout: Layout,
+    /// Its vendor and product ids, when the kernel gives them.
+    pub ids: Option<(u16, u16)>,
 }
 
 /// The first hidraw interface that is a multi-axis controller with motion axes, whoever made it.
@@ -21,9 +39,122 @@ pub fn find() -> Option<Device> {
     names.into_iter().find_map(|name| probe(&Path::new(SYSFS).join(&name), Path::new(DEV).join(&name)))
 }
 
+/// Hands every report to `publish` until the device is gone (end of file or an error) or `stop`
+/// says so. `source` is non-blocking: when it has nothing, `stop` is asked and the reader waits
+/// [`IDLE_POLL`]. Reports are read and handed over exactly as they were with blocking reads.
+pub fn read_reports(mut source: impl Read, mut publish: impl FnMut(&[u8]), mut stop: impl FnMut() -> bool) {
+    let mut report = [0_u8; super::REPORT_BUFFER_BYTES];
+    loop {
+        match source.read(&mut report) {
+            Ok(0) => return,
+            Ok(size) => publish(report.get(..size).unwrap_or_default()),
+            Err(error) if error.kind() == std::io::ErrorKind::Interrupted => {}
+            Err(error) if error.kind() == std::io::ErrorKind::WouldBlock => {
+                if stop() {
+                    return;
+                }
+                std::thread::sleep(IDLE_POLL);
+            }
+            Err(error) => {
+                log::info!("3D mouse disconnected: {error}");
+                return;
+            }
+        }
+    }
+}
+
 fn probe(sysfs: &Path, path: PathBuf) -> Option<Device> {
     let descriptor = Descriptor::parse(&std::fs::read(sysfs.join("device/report_descriptor")).ok()?);
     // A controller that declares no motion axis (buttons only, say) isn't read.
     let layout = descriptor.is_multi_axis_controller().then(|| descriptor.layout()).flatten()?;
-    Some(Device { path, layout })
+    let ids = std::fs::read_to_string(sysfs.join("device/uevent")).ok().as_deref().and_then(ids);
+    Some(Device { path, layout, ids })
+}
+
+/// The vendor and product ids in a HID device's uevent: `HID_ID=bus:vendor:product`, in hex.
+fn ids(uevent: &str) -> Option<(u16, u16)> {
+    let id = uevent.lines().find_map(|line| line.strip_prefix("HID_ID="))?;
+    let mut hex = id.split(':').skip(1).map(|part| u32::from_str_radix(part, 16).ok().and_then(|v| u16::try_from(v).ok()));
+    Some((hex.next()??, hex.next()??))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A real EACCES, as a user without the udev rule gets: a file of the user's own with no permission
+    /// bits. Skipped for root, which can open anything.
+    #[test]
+    fn a_device_without_permission_is_denied_and_the_daemon_takes_over_within_the_backoff() {
+        use std::os::unix::fs::{MetadataExt, PermissionsExt};
+        if std::fs::metadata("/proc/self").is_ok_and(|meta| meta.uid() == 0) {
+            return;
+        }
+        let dir = std::env::temp_dir().join(format!("sc-hidraw-denied-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let node = dir.join("hidraw0");
+        std::fs::write(&node, [0_u8; 4]).unwrap();
+        std::fs::set_permissions(&node, std::fs::Permissions::from_mode(0o000)).unwrap();
+        let denied = open(&node);
+        std::fs::set_permissions(&node, std::fs::Permissions::from_mode(0o600)).unwrap();
+        assert!(open(&node).is_ok(), "the same node opens once it is readable");
+        std::fs::remove_dir_all(&dir).ok();
+        assert_eq!(denied.err().map(|error| error.kind()), Some(std::io::ErrorKind::PermissionDenied));
+        // The failure is the choice's `since_failed`, with an injected clock: inside the backoff the
+        // daemon is read, whichever driver was asked for; after it the device is tried again.
+        use super::super::{Pick, SpaceMouseDriver, UNREADABLE_RETRY, choose, direct_usable};
+        for wanted in [SpaceMouseDriver::Automatic, SpaceMouseDriver::Spacenavd, SpaceMouseDriver::Direct] {
+            for ago in [Duration::ZERO, Duration::from_secs(29)] {
+                assert_eq!(choose(wanted, true, direct_usable(true, Some(ago), UNREADABLE_RETRY)), Some(Pick::Spacenavd), "{wanted:?} {ago:?}");
+            }
+        }
+        assert_eq!(choose(SpaceMouseDriver::Direct, true, direct_usable(true, Some(UNREADABLE_RETRY), UNREADABLE_RETRY)), Some(Pick::Direct));
+        // And the daemon's own reader delivers over a fake connection.
+        let (mut daemon, client) = std::os::unix::net::UnixStream::pair().unwrap();
+        let mut record = [0_u8; 32];
+        record[4..8].copy_from_slice(&100_i32.to_ne_bytes());
+        std::io::Write::write_all(&mut daemon, &record).unwrap();
+        drop(daemon);
+        let mut seen = 0;
+        super::super::spacenavd::read(client, |_| seen += 1, |_, _| {}, || false, Duration::from_secs(3600));
+        assert_eq!(seen, 1);
+    }
+
+    #[test]
+    fn reports_come_through_idle_gaps_until_the_device_ends_or_a_stop() {
+        use crate::space_mouse::fake::Script;
+        let mut script = Script::new();
+        script.timeout(std::io::ErrorKind::WouldBlock).data(&[1, 2, 3]).timeout(std::io::ErrorKind::WouldBlock).data(&[4]).end();
+        let (mut seen, mut asked) = (Vec::new(), 0);
+        read_reports(
+            script,
+            |report| seen.push(report.to_vec()),
+            || {
+                asked += 1;
+                false
+            },
+        );
+        assert_eq!(seen, [vec![1, 2, 3], vec![4]]);
+        assert_eq!(asked, 2);
+        let mut script = Script::new();
+        script.data(&[1]).timeout(std::io::ErrorKind::WouldBlock).data(&[2]);
+        let mut seen = Vec::new();
+        read_reports(script, |report| seen.push(report.to_vec()), || true);
+        assert_eq!(seen, [vec![1]], "a stop at an idle moment ends the read");
+        // An unplugged device is an error, which ends the read as before.
+        let mut script = Script::new();
+        script.data(&[1]).fail(std::io::ErrorKind::BrokenPipe).data(&[2]);
+        let mut seen = Vec::new();
+        read_reports(script, |report| seen.push(report.to_vec()), || false);
+        assert_eq!(seen, [vec![1]]);
+    }
+
+    #[test]
+    fn ids_come_from_the_uevent() {
+        let wireless = "DRIVER=hid-generic\nHID_ID=0005:0000256F:0000C63A\nHID_NAME=SpaceMouse Wireless BT\n";
+        assert_eq!(ids(wireless), Some((0x256f, 0xc63a)));
+        assert_eq!(ids("HID_ID=0003:0000046D\n"), None);
+        assert_eq!(ids("HID_ID=0003:0001046D:0000C62B\n"), None, "a vendor past 16 bits isn't a USB id");
+        assert_eq!(ids("HID_NAME=keyboard\n"), None);
+    }
 }

apps/solidcraft/src/space_mouse/spacenavd.rs

@@ -3,7 +3,8 @@
 //! to its clients, so a program that reads the HID device itself bypasses that setup. Over its
 //! socket the daemon sends fixed 32-byte records: eight native-endian `i32`, the first the kind of
 //! record (0 for motion, then x y z rx ry rz and the milliseconds since the last record).
-//! Other records (button presses, from newer daemons also configuration changes) are ignored.
+//! Button records (1 pressed, 2 released, then the button's number from 0) are read too; other
+//! records (from newer daemons also configuration changes) are ignored.
 //!
 //! The socket is plain file I/O, so no library is needed, and it needs no udev rule: the daemon
 //! is what has access to the device.
@@ -11,6 +12,7 @@
 use std::io::Read;
 use std::os::unix::net::UnixStream;
 use std::path::Path;
+use std::time::{Duration, Instant};
 
 use solidcraft_ui_egui::space_mouse::{Axes, FULL_SCALE};
 
@@ -23,6 +25,11 @@ const RECORD_BYTES: usize = 32;
 /// sensitivity). Our axes are in the raw HID units of [`FULL_SCALE`].
 const DAEMON_FULL_SCALE: i64 = 500;
 
+/// Whether the daemon's socket is there, without connecting to it.
+pub fn exists() -> bool {
+    SOCKETS.iter().any(|path| Path::new(path).exists())
+}
+
 pub fn connect() -> Option<UnixStream> {
     SOCKETS.iter().find_map(|path| connect_to(Path::new(path)))
 }
@@ -49,6 +56,22 @@ fn decode(record: &[u8; RECORD_BYTES]) -> Option<Axes> {
     })
 }
 
+/// The button a button record is about, from 0, and whether it went down; `None` for any other
+/// record, or a button past the 32 a bitmask holds.
+fn button(record: &[u8; RECORD_BYTES]) -> Option<(u32, bool)> {
+    let mut data = [0_i32; 2];
+    for (slot, bytes) in data.iter_mut().zip(record.as_chunks::<4>().0) {
+        *slot = i32::from_ne_bytes(*bytes);
+    }
+    let [kind, number] = data;
+    let number = u32::try_from(number).ok().filter(|&n| n < 32)?;
+    match kind {
+        1 => Some((number, true)),
+        2 => Some((number, false)),
+        _ => None,
+    }
+}
+
 /// A daemon value in our raw units. Out-of-range values stay in `i16`: they are input from another
 /// process.
 fn unit(value: impl Into<i64>) -> i16 {
@@ -56,18 +79,53 @@ fn unit(value: impl Into<i64>) -> i16 {
     i16::try_from(scaled.clamp(i64::from(i16::MIN), i64::from(i16::MAX))).unwrap_or_default()
 }
 
-/// Hands every motion record to `publish` until the daemon closes the connection or fails. A
-/// partial record at the end is dropped.
-pub fn read(mut stream: impl Read, mut publish: impl FnMut(Axes)) {
+/// Hands every motion record to `publish` and every button record to `pressed` until the daemon
+/// closes the connection or fails, or `stop` says so. A stream with a read timeout
+/// (`set_read_timeout`) times out when the daemon is quiet, which is no record and no disconnect:
+/// `stop` is asked, and the read goes on, with what of a record had arrived kept. `stop` is also asked
+/// at least every `check_every` while records keep arriving, so a daemon that never pauses for that
+/// long (a moving cap sends every few milliseconds) does not keep the reader from noticing that the
+/// device it prefers is back. A partial record at the end is dropped.
+pub fn read(
+    mut stream: impl Read,
+    mut publish: impl FnMut(Axes),
+    mut pressed: impl FnMut(u32, bool),
+    mut stop: impl FnMut() -> bool,
+    check_every: Duration,
+) {
     let mut record = [0_u8; RECORD_BYTES];
+    let mut filled = 0;
+    let mut asked = Instant::now();
     loop {
-        match stream.read_exact(&mut record) {
-            Ok(()) => {
-                if let Some(axes) = decode(&record) {
-                    publish(axes);
+        if asked.elapsed() >= check_every {
+            asked = Instant::now();
+            if stop() {
+                return;
+            }
+        }
+        match stream.read(record.get_mut(filled..).unwrap_or_default()) {
+            Ok(0) => {
+                log::info!("3D mouse: spacenavd connection ended");
+                return;
+            }
+            Ok(size) => {
+                filled += size;
+                if filled == RECORD_BYTES {
+                    filled = 0;
+                    if let Some(axes) = decode(&record) {
+                        publish(axes);
+                    } else if let Some((number, down)) = button(&record) {
+                        pressed(number, down);
+                    }
                 }
             }
             Err(error) if error.kind() == std::io::ErrorKind::Interrupted => {}
+            Err(error) if matches!(error.kind(), std::io::ErrorKind::WouldBlock | std::io::ErrorKind::TimedOut) => {
+                asked = Instant::now();
+                if stop() {
+                    return;
+                }
+            }
             Err(error) => {
                 log::info!("3D mouse: spacenavd connection ended: {error}");
                 return;
@@ -113,6 +171,10 @@ mod tests {
     fn other_records_and_hostile_values_are_harmless() {
         // A button record (kind 1, press) and one of an unknown kind are not motion.
         assert_eq!(decode(&record([1, 0, 1, 0, 0, 0, 0, 0])), None);
+        // Nor are hostile button numbers a button.
+        assert_eq!(button(&record([1, -1, 0, 0, 0, 0, 0, 0])), None);
+        assert_eq!(button(&record([1, i32::MAX, 0, 0, 0, 0, 0, 0])), None);
+        assert_eq!(button(&record([7, 3, 0, 0, 0, 0, 0, 0])), None);
         assert_eq!(decode(&record([7, 500, 500, 500, 500, 500, 500, 0])), None);
         // Nothing overflows on the extremes of `i32`.
         let extreme = decode(&record([0, i32::MIN, i32::MIN, i32::MAX, i32::MAX, i32::MIN, i32::MIN, -1]));
@@ -126,14 +188,84 @@ mod tests {
         let (mut daemon, client) = UnixStream::pair().expect("a socket pair");
         let mut bytes = Vec::new();
         bytes.extend(record([0, 100, 0, 0, 0, 0, 0, 8]));
-        bytes.extend(record([2, 1, 0, 0, 0, 0, 0, 0])); // a button release: skipped
+        bytes.extend(record([1, 4, 0, 0, 0, 0, 0, 0])); // button 4 down
+        bytes.extend(record([2, 4, 0, 0, 0, 0, 0, 0])); // and up
+        bytes.extend(record([1, 40, 0, 0, 0, 0, 0, 0])); // past the 32 a bitmask holds: skipped
         bytes.extend(record([0, 0, 0, 0, 0, 0, 0, 900]));
         bytes.extend([1, 2, 3]); // the daemon went away mid-record
         daemon.write_all(&bytes).expect("written");
         drop(daemon);
-        let mut seen = Vec::new();
-        read(client, |axes| seen.push(axes.translation));
+        let (mut seen, mut buttons) = (Vec::new(), Vec::new());
+        read(client, |axes| seen.push(axes.translation), |number, down| buttons.push((number, down)), || false, Duration::from_secs(3600));
         assert_eq!(seen, [[70, 0, 0], [0, 0, 0]]);
+        assert_eq!(buttons, [(4, true), (4, false)]);
+    }
+
+    #[test]
+    fn a_quiet_daemon_times_out_without_losing_the_record_it_was_sending() {
+        use crate::space_mouse::fake::Script;
+        use std::io::ErrorKind::{TimedOut, WouldBlock};
+        let bytes = record([0, 100, 0, 0, 0, 0, 0, 8]);
+        let mut script = Script::new();
+        script.timeout(WouldBlock).data(&bytes[..10]).timeout(TimedOut).timeout(WouldBlock).data(&bytes[10..]).timeout(WouldBlock).end();
+        let (mut seen, mut asked) = (Vec::new(), 0);
+        read(
+            script,
+            |axes| seen.push(axes.translation),
+            |_, _| {},
+            || {
+                asked += 1;
+                false
+            },
+            Duration::from_secs(3600),
+        );
+        assert_eq!(seen, [[70, 0, 0]]);
+        assert_eq!(asked, 4, "each timeout asks whether to stop");
+    }
+
+    #[test]
+    fn a_stop_ends_the_read_at_the_next_timeout_only() {
+        use crate::space_mouse::fake::Script;
+        let bytes = record([0, 100, 0, 0, 0, 0, 0, 8]);
+        let mut script = Script::new();
+        script.data(&bytes).timeout(std::io::ErrorKind::WouldBlock).data(&bytes);
+        let mut seen = 0;
+        read(script, |_| seen += 1, |_, _| {}, || true, Duration::from_secs(3600));
+        assert_eq!(seen, 1, "the record before the timeout arrived; the one after never was read");
+    }
+
+    /// A daemon that never goes quiet (a moving cap sends every few milliseconds) is still asked whether to
+    /// stop, at the interval given, so the reader can go back to a device that returned.
+    #[test]
+    fn a_busy_daemon_is_asked_whether_to_stop_on_a_timer() {
+        // Ends by itself after half a second, so a read that never asks fails the assertion below
+        // instead of hanging the test.
+        struct Busy(Instant);
+        impl Read for Busy {
+            fn read(&mut self, buf: &mut [u8]) -> std::io::Result<usize> {
+                if self.0.elapsed() > Duration::from_millis(500) {
+                    return Ok(0);
+                }
+                std::thread::sleep(Duration::from_millis(2));
+                let bytes = record([0, 100, 0, 0, 0, 0, 0, 8]);
+                let size = bytes.len().min(buf.len());
+                buf[..size].copy_from_slice(&bytes[..size]);
+                Ok(size)
+            }
+        }
+        let (mut seen, mut asked) = (0, 0);
+        read(
+            Busy(Instant::now()),
+            |_| seen += 1,
+            |_, _| {},
+            || {
+                asked += 1;
+                asked == 3
+            },
+            Duration::from_millis(10),
+        );
+        assert_eq!(asked, 3, "asked on the timer although no read ever timed out");
+        assert!(seen > 3, "records kept coming meanwhile: {seen}");
     }
 
     #[test]

apps/solidcraft/src/space_mouse/windows_hid.rs

@@ -0,0 +1,172 @@
+//! Windows: finding 3D mice without asking any other device anything (#2614).
+//!
+//! hidapi's enumeration opens every HID interface and reads its serial number, manufacturer and
+//! product strings: on USB, three control requests to every keyboard, mouse and touchscreen. The
+//! reader repeated it every two seconds while no 3D mouse was plugged in, and on some machines the
+//! keyboard then kept dropping off the bus and the cursor jumped. Plug and Play already names each
+//! interface's top-level usage in its hardware IDs (`HID_DEVICE_UP:0001_U:0008`: Generic Desktop,
+//! Multi-Axis Controller), so the reader asks it, which sends nothing to any device, and opens only
+//! the interfaces that are 3D mice.
+//!
+//! The configuration manager has no safe API, hence the `unsafe_code` allowance on this module
+//! (the app crate denies it; see `native_crash.rs`).
+#![allow(unsafe_code)]
+
+use std::ffi::CString;
+use std::ptr::{null, null_mut};
+
+use windows_sys::Win32::Devices::DeviceAndDriverInstallation::{
+    CM_GET_DEVICE_INTERFACE_LIST_PRESENT, CM_Get_DevNode_PropertyW, CM_Get_Device_Interface_List_SizeW, CM_Get_Device_Interface_ListW,
+    CM_Get_Device_Interface_PropertyW, CM_LOCATE_DEVNODE_NORMAL, CM_Locate_DevNodeW, CONFIGRET, CR_BUFFER_SMALL, CR_SUCCESS,
+};
+use windows_sys::Win32::Devices::HumanInterfaceDevice::GUID_DEVINTERFACE_HID;
+use windows_sys::Win32::Devices::Properties::{
+    DEVPKEY_Device_HardwareIds, DEVPKEY_Device_InstanceId, DEVPROP_TYPE_STRING, DEVPROP_TYPE_STRING_LIST, DEVPROPTYPE,
+};
+use windows_sys::Win32::Foundation::DEVPROPKEY;
+
+/// The hardware ID Windows gives a top-level collection with the Generic Desktop page's
+/// Multi-Axis Controller usage.
+const MULTI_AXIS_CONTROLLER: &str = "HID_DEVICE_UP:0001_U:0008";
+/// Largest property read, in bytes: hardware IDs are a few hundred.
+const MAX_PROPERTY_BYTES: u32 = 64 * 1024;
+/// Tries at reading the interface list, which can grow between asking its size and reading it.
+const LIST_TRIES: usize = 4;
+
+/// The paths of the present HID interfaces whose top-level collection is a multi-axis controller.
+pub fn multi_axis_controllers() -> Vec<CString> {
+    interfaces()
+        .into_iter()
+        .filter(|path| {
+            let Some(instance) = interface_strings(path, &DEVPKEY_Device_InstanceId).and_then(|ids| ids.into_iter().next()) else {
+                return false;
+            };
+            devnode_strings(&instance, &DEVPKEY_Device_HardwareIds).is_some_and(|ids| is_multi_axis(&ids))
+        })
+        .filter_map(|path| CString::new(path).ok())
+        .collect()
+}
+
+/// Whether a device with these hardware IDs is a multi-axis controller.
+fn is_multi_axis(hardware_ids: &[String]) -> bool {
+    hardware_ids.iter().any(|id| id.eq_ignore_ascii_case(MULTI_AXIS_CONTROLLER))
+}
+
+/// The strings of a nul-separated list (`REG_MULTI_SZ`, or one string), without empty ones.
+fn split_multi_sz(buffer: &[u16]) -> Vec<String> {
+    buffer.split(|c| *c == 0).filter(|s| !s.is_empty()).map(String::from_utf16_lossy).collect()
+}
+
+/// `s` as a nul-terminated wide string.
+fn wide(s: &str) -> Vec<u16> {
+    s.encode_utf16().chain(std::iter::once(0)).collect()
+}
+
+/// The paths of the present HID interfaces.
+fn interfaces() -> Vec<String> {
+    for _ in 0..LIST_TRIES {
+        let mut len = 0u32;
+        // SAFETY: `len` is a valid place for the size; the class GUID is a static; no device filter.
+        let sized = unsafe { CM_Get_Device_Interface_List_SizeW(&mut len, &GUID_DEVINTERFACE_HID, null(), CM_GET_DEVICE_INTERFACE_LIST_PRESENT) };
+        if sized != CR_SUCCESS || len == 0 {
+            return Vec::new();
+        }
+        let mut buffer = vec![0u16; len as usize];
+        // SAFETY: `buffer` holds `len` wide characters, the length the call is given.
+        let listed =
+            unsafe { CM_Get_Device_Interface_ListW(&GUID_DEVINTERFACE_HID, null(), buffer.as_mut_ptr(), len, CM_GET_DEVICE_INTERFACE_LIST_PRESENT) };
+        match listed {
+            CR_SUCCESS => return split_multi_sz(&buffer),
+            CR_BUFFER_SMALL => continue,
+            _ => return Vec::new(),
+        }
+    }
+    Vec::new()
+}
+
+/// A string or string-list property, read by `get` (property type, buffer, its size in bytes) in
+/// two calls: the size, then the value.
+fn property_strings(get: impl Fn(*mut DEVPROPTYPE, *mut u8, *mut u32) -> CONFIGRET) -> Option<Vec<String>> {
+    let mut kind: DEVPROPTYPE = 0;
+    let mut size = 0u32;
+    if get(&mut kind, null_mut(), &mut size) != CR_BUFFER_SMALL || size == 0 || size > MAX_PROPERTY_BYTES {
+        return None;
+    }
+    let mut buffer = vec![0u16; (size as usize).div_ceil(2)];
+    let mut size = (buffer.len() * 2) as u32;
+    if get(&mut kind, buffer.as_mut_ptr().cast(), &mut size) != CR_SUCCESS || (kind != DEVPROP_TYPE_STRING && kind != DEVPROP_TYPE_STRING_LIST) {
+        return None;
+    }
+    Some(split_multi_sz(&buffer))
+}
+
+/// A string property of the device interface at `path`.
+fn interface_strings(path: &str, key: &DEVPROPKEY) -> Option<Vec<String>> {
+    let path = wide(path);
+    property_strings(|kind, buffer, size| {
+        // SAFETY: `path` is nul-terminated and outlives the call; `buffer` is null (asking the size)
+        // or holds `*size` bytes, as `property_strings` sets up.
+        unsafe { CM_Get_Device_Interface_PropertyW(path.as_ptr(), key, kind, buffer, size, 0) }
+    })
+}
+
+/// A string property of the device with instance ID `instance`.
+fn devnode_strings(instance: &str, key: &DEVPROPKEY) -> Option<Vec<String>> {
+    let instance = wide(instance);
+    let mut devnode = 0u32;
+    // SAFETY: `instance` is nul-terminated and outlives the call; `devnode` is a valid place for the result.
+    if unsafe { CM_Locate_DevNodeW(&mut devnode, instance.as_ptr(), CM_LOCATE_DEVNODE_NORMAL) } != CR_SUCCESS {
+        return None;
+    }
+    property_strings(|kind, buffer, size| {
+        // SAFETY: `buffer` is null (asking the size) or holds `*size` bytes, as `property_strings` sets up.
+        unsafe { CM_Get_DevNode_PropertyW(devnode, key, kind, buffer, size, 0) }
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The hardware IDs Windows gives a wired 3Dconnexion device's motion interface, and a
+    /// keyboard's: only the first is a multi-axis controller.
+    #[test]
+    fn only_the_multi_axis_usage_is_a_3d_mouse() {
+        let ids = |list: &[&str]| list.iter().map(|s| s.to_string()).collect::<Vec<_>>();
+        let space_mouse = ids(&["HID\\VID_256F&PID_C635&REV_0437&MI_00", "HID\\VID_256F&UP:0001_U:0008", "HID_DEVICE_UP:0001_U:0008", "HID_DEVICE"]);
+        let keyboard = ids(&[
+            "HID\\VID_046D&PID_C31C&REV_6400&MI_00",
+            "HID\\VID_046D&UP:0001_U:0006",
+            "HID_DEVICE_SYSTEM_KEYBOARD",
+            "HID_DEVICE_UP:0001_U:0006",
+            "HID_DEVICE",
+        ]);
+        let vendor = ids(&["HID\\VID_256F&UP:FF00_U:0001", "HID_DEVICE_UP:FF00_U:0001", "HID_DEVICE_UPR:FF00-FFFF", "HID_DEVICE"]);
+        assert!(is_multi_axis(&space_mouse));
+        assert!(is_multi_axis(&ids(&["hid_device_up:0001_u:0008"])), "IDs compare without regard to case");
+        assert!(!is_multi_axis(&keyboard) && !is_multi_axis(&vendor) && !is_multi_axis(&[]));
+    }
+
+    #[test]
+    fn nul_separated_lists_split_into_their_strings() {
+        let buffer: Vec<u16> = "a\\b\0HID_DEVICE\0\0".encode_utf16().collect();
+        assert_eq!(split_multi_sz(&buffer), ["a\\b", "HID_DEVICE"]);
+        assert_eq!(split_multi_sz(&wide("one")), ["one"]);
+        assert!(split_multi_sz(&[0, 0]).is_empty() && split_multi_sz(&[]).is_empty());
+    }
+
+    /// The scan asks Plug and Play only: on any machine it returns, and every path it returns is a
+    /// present HID interface whose hardware IDs name the multi-axis usage.
+    #[test]
+    fn the_scan_returns_only_multi_axis_interfaces() {
+        let found = multi_axis_controllers();
+        let all = interfaces();
+        for path in &found {
+            let path = path.to_str().unwrap_or_default();
+            assert!(all.iter().any(|p| p == path), "{path}");
+            let instance = interface_strings(path, &DEVPKEY_Device_InstanceId).and_then(|ids| ids.into_iter().next()).unwrap_or_default();
+            assert!(devnode_strings(&instance, &DEVPKEY_Device_HardwareIds).is_some_and(|ids| is_multi_axis(&ids)), "{path}");
+        }
+        eprintln!("{} HID interfaces present, {} multi-axis controllers", all.len(), found.len());
+    }
+}

apps/solidcraft/src/startup.rs

@@ -21,6 +21,25 @@ pub const RENDERER_ENV: &str = "SOLIDCRAFT_RENDERER";
 pub const FAILED_STARTS_FOR_SAFE_MODE: u32 = 2;
 const MARKER: &str = "starting";
 
+/// Explicit application-settings isolation for side-by-side builds and native UI
+/// acceptance. A supplied invalid path refuses startup rather than falling back
+/// to the user's ordinary settings. No directory is read or created here.
+pub fn settings_directory(override_path: Option<&std::ffi::OsStr>, default: Option<PathBuf>) -> Result<Option<PathBuf>, String> {
+    match override_path {
+        None => Ok(default),
+        Some(raw) => {
+            let path = PathBuf::from(raw);
+            if raw.is_empty() || !path.is_absolute() {
+                return Err("SOLIDCRAFT_SETTINGS_DIR must be a nonempty absolute directory path".into());
+            }
+            if path.exists() && !path.is_dir() {
+                return Err("SOLIDCRAFT_SETTINGS_DIR names a file, not a directory".into());
+            }
+            Ok(Some(path))
+        }
+    }
+}
+
 /// Whether an environment value switches something on.
 pub fn env_on(v: Option<&str>) -> bool {
     v.map(str::trim).is_some_and(|v| !v.is_empty() && v != "0" && !v.eq_ignore_ascii_case("false"))
@@ -110,6 +129,48 @@ pub fn pick_cpu_adapter(adapters: &[eframe::wgpu::Adapter], surface: Option<&efr
         })
 }
 
+/// Adapter properties used to choose a card without opening a device.
+#[derive(Clone, Debug)]
+pub struct AdapterChoice {
+    pub name: String,
+    pub compatible: bool,
+}
+
+/// Choose only surface-compatible adapters. Names saved in preferences are exact; the
+/// environment override follows wgpu's case-insensitive substring convention.
+/// No match leaves selection to the normal wgpu request.
+pub fn choose_adapter(adapters: &[AdapterChoice], environment: Option<&str>, preference: Option<&str>) -> Option<usize> {
+    // wgpu's environment helper panics on a missing name; an override must remain recoverable.
+    let compatible = || adapters.iter().enumerate().filter(|(_, a)| a.compatible);
+    if let Some(name) = environment.filter(|s| !s.is_empty()) {
+        let name = name.to_lowercase();
+        if let Some((index, _)) = compatible().find(|(_, a)| a.name.to_lowercase().contains(&name)) {
+            return Some(index);
+        }
+    }
+    if let Some(name) = preference.filter(|s| !s.is_empty())
+        && let Some((index, _)) = compatible().find(|(_, a)| a.name == name)
+    {
+        return Some(index);
+    }
+    None
+}
+
+/// Leave Automatic on wgpu's normal request path; named choices may defer to it too.
+pub fn configure_adapter(setup: &mut eframe::egui_wgpu::WgpuSetupCreateNew, cpu: bool, environment: Option<String>, preference: Option<String>) {
+    if cpu {
+        setup.native_adapter_selector = Some(std::sync::Arc::new(|adapters, surface| pick_cpu_adapter(adapters, surface).map(Some)));
+    } else if environment.as_deref().is_some_and(|s| !s.is_empty()) || preference.as_deref().is_some_and(|s| !s.is_empty()) {
+        setup.native_adapter_selector = Some(std::sync::Arc::new(move |adapters, surface| {
+            let choices: Vec<_> = adapters
+                .iter()
+                .map(|a| AdapterChoice { name: a.get_info().name, compatible: surface.is_none_or(|s| a.is_surface_supported(s)) })
+                .collect();
+            Ok(choose_adapter(&choices, environment.as_deref(), preference.as_deref()).and_then(|i| adapters.get(i)).cloned())
+        }));
+    }
+}
+
 /// `WGPU_BACKEND`: when set, wgpu picks the backends from it and the order below is not used.
 pub const WGPU_BACKEND_ENV: &str = "WGPU_BACKEND";
 
@@ -189,6 +250,29 @@ pub fn has_hardware_adapter(backends: eframe::wgpu::Backends) -> bool {
     adapters.iter().any(|a| a.get_info().device_type != eframe::wgpu::DeviceType::Cpu)
 }
 
+/// The environment variable that switches wgpu's indirect-call validation on or off.
+pub const INDIRECT_VALIDATION_ENV: &str = "WGPU_VALIDATION_INDIRECT_CALL";
+
+/// The instance flags for the window. wgpu's indirect-call validation compiles a compute shader
+/// when the device is created, and on Intel Macs (macOS 12 with Intel Iris graphics, #3024,
+/// #3080, #4605) the Metal compiler refuses it: the device is lost and the window never opens.
+/// So on an Intel Mac the validation is left off, unless the user turned it on or off with
+/// `WGPU_VALIDATION_INDIRECT_CALL` themselves.
+pub fn window_instance_flags(flags: eframe::wgpu::InstanceFlags, intel_mac: bool, env: Option<&str>) -> eframe::wgpu::InstanceFlags {
+    if intel_mac && env.map(str::trim).is_none_or(str::is_empty) { flags - eframe::wgpu::InstanceFlags::VALIDATION_INDIRECT_CALL } else { flags }
+}
+
+/// Windows with OpenGL: the window keeps the system title bar (#2063). The window without OS
+/// decorations keeps its caption style while having no frame, and some OpenGL drivers (older
+/// Intel HD/UHD) then show the picture a caption's height lower than the window, so it no longer
+/// lines up with the pointer. Direct3D 12 and Vulkan draw it in place and keep the application bar
+/// as the title bar. `backends` are the ones wgpu starts: OpenGL alone is decided before the
+/// window opens.
+pub fn system_title_bar(windows: bool, backends: eframe::wgpu::Backends) -> bool {
+    use eframe::wgpu::Backends;
+    windows && backends.contains(Backends::GL) && !backends.intersects(Backends::DX12 | Backends::VULKAN)
+}
+
 /// The message shown when no window could be opened at all.
 pub fn no_window_message(error: &str, settings: Option<&Path>) -> String {
     let folder = settings.map(|d| d.display().to_string()).unwrap_or_else(|| "the SolidCraft settings folder".into());
@@ -207,6 +291,48 @@ pub fn no_window_message(error: &str, settings: Option<&Path>) -> String {
 mod tests {
     use super::*;
 
+    fn cards() -> Vec<AdapterChoice> {
+        ["Integrated", "Discrete small", "Discrete large"].into_iter().map(|name| AdapterChoice { name: name.into(), compatible: true }).collect()
+    }
+
+    #[test]
+    fn adapter_names_environment_override_and_missing_card_fallback() {
+        let cards = cards();
+        assert_eq!(choose_adapter(&cards, None, Some("Discrete small")), Some(1));
+        assert_eq!(choose_adapter(&cards, Some("LARGE"), Some("Discrete small")), Some(2));
+        assert_eq!(choose_adapter(&cards, None, Some("removed")), None);
+        assert_eq!(choose_adapter(&cards, Some("missing"), Some("Discrete small")), Some(1));
+        assert_eq!(choose_adapter(&cards, Some(""), Some("Discrete small")), Some(1));
+        assert_eq!(choose_adapter(&cards, None, Some("Discrete")), None, "saved names are exact");
+    }
+
+    #[test]
+    fn automatic_adapter_leaves_selection_to_wgpu() {
+        let mut cards = cards();
+        assert_eq!(choose_adapter(&cards, None, None), None);
+        assert_eq!(choose_adapter(&cards, Some(""), Some("")), None);
+        cards[2].compatible = false;
+        assert_eq!(choose_adapter(&cards, Some("large"), Some("Discrete large")), None);
+        assert_eq!(choose_adapter(&cards, Some("small"), None), Some(1));
+        assert_eq!(choose_adapter(&[], None, None), None);
+    }
+
+    #[test]
+    fn automatic_adapter_preserves_the_previous_request_configuration() {
+        use eframe::egui_wgpu::WgpuSetupCreateNew;
+        let previous = WgpuSetupCreateNew::without_display_handle();
+        for preference in [None, Some(String::new())] {
+            let mut setup = WgpuSetupCreateNew::without_display_handle();
+            configure_adapter(&mut setup, false, None, preference);
+            assert!(setup.native_adapter_selector.is_none(), "Automatic must use the normal wgpu request");
+            assert_eq!(setup.power_preference, previous.power_preference);
+            assert_eq!(setup.instance_descriptor.backends, previous.instance_descriptor.backends);
+        }
+        let mut setup = WgpuSetupCreateNew::without_display_handle();
+        configure_adapter(&mut setup, false, Some("missing".into()), Some("removed".into()));
+        assert!(setup.native_adapter_selector.unwrap()(&[], None).unwrap().is_none(), "missing names must use the normal request too");
+    }
+
     fn scratch(name: &str) -> PathBuf {
         let d = std::env::temp_dir().join(format!("solidcraft-startup-{name}-{}", std::process::id()));
         let _ = std::fs::remove_dir_all(&d);
@@ -214,6 +340,32 @@ mod tests {
         d
     }
 
+    #[test]
+    fn isolated_settings_are_explicit_absolute_and_never_fall_back() {
+        let default = std::env::temp_dir().join("ordinary-settings");
+        assert_eq!(settings_directory(None, Some(default.clone())).unwrap(), Some(default.clone()));
+        let selected = std::env::temp_dir().join("solidcraft-isolated-settings-fixture");
+        assert_eq!(settings_directory(Some(selected.as_os_str()), Some(default.clone())).unwrap(), Some(selected));
+        for raw in ["", "relative/settings", "../ordinary"] {
+            assert!(settings_directory(Some(std::ffi::OsStr::new(raw)), Some(default.clone())).is_err());
+        }
+        let file = std::env::current_exe().unwrap();
+        assert!(settings_directory(Some(file.as_os_str()), Some(default)).is_err());
+    }
+
+    #[test]
+    fn intel_macs_start_without_indirect_call_validation() {
+        use eframe::wgpu::InstanceFlags as F;
+        let on = F::VALIDATION | F::VALIDATION_INDIRECT_CALL;
+        assert_eq!(window_instance_flags(on, true, None), F::VALIDATION);
+        assert_eq!(window_instance_flags(on, true, Some("  ")), F::VALIDATION);
+        // The user's own choice stands, on or off.
+        assert_eq!(window_instance_flags(on, true, Some("1")), on);
+        assert_eq!(window_instance_flags(F::VALIDATION, true, Some("0")), F::VALIDATION);
+        // Every other machine keeps what it had.
+        assert_eq!(window_instance_flags(on, false, None), on);
+    }
+
     #[test]
     fn switches_read_from_the_environment() {
         assert!(env_on(Some("1")) && env_on(Some("yes")) && !env_on(Some("0")) && !env_on(Some(" ")) && !env_on(None) && !env_on(Some("false")));
@@ -290,6 +442,18 @@ mod tests {
         assert_eq!(choose_backends(true, false, false, Some(""), probe(&[Backends::GL])), Some(Backends::GL));
     }
 
+    #[test]
+    fn only_opengl_on_windows_gets_the_system_title_bar() {
+        use eframe::wgpu::Backends;
+        assert!(system_title_bar(true, Backends::GL));
+        for b in [Backends::DX12, Backends::VULKAN, Backends::DX12 | Backends::GL, Backends::VULKAN | Backends::GL, Backends::all()] {
+            assert!(!system_title_bar(true, b), "{b:?}");
+        }
+        for b in [Backends::GL, Backends::VULKAN, Backends::METAL] {
+            assert!(!system_title_bar(false, b), "{b:?}");
+        }
+    }
+
     #[test]
     fn wgpu_backend_the_preference_and_the_software_renderer_override_the_order() {
         use eframe::wgpu::Backends;

apps/solidcraft/src/window_fit.rs

@@ -0,0 +1,117 @@
+//! Keeping the restored window reachable.
+//!
+//! The window comes back where it was left. After a monitor was unplugged, the scale changed or
+//! the settings came from a larger screen, that can put its title bar above the top edge or
+//! under the taskbar, out of reach of the mouse. [`fit`] pulls a window back into the monitor's
+//! work area (the screen without the taskbar), in whatever unit the caller measures both, as
+//! long as it is the same one.
+
+/// A rectangle: left, top, width, height.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Area {
+    pub x: f32,
+    pub y: f32,
+    pub w: f32,
+    pub h: f32,
+}
+
+impl Area {
+    pub const fn new(x: f32, y: f32, w: f32, h: f32) -> Self {
+        Area { x, y, w, h }
+    }
+    fn right(self) -> f32 {
+        self.x + self.w
+    }
+    fn bottom(self) -> f32 {
+        self.y + self.h
+    }
+    fn sane(self) -> bool {
+        [self.x, self.y, self.w, self.h].iter().all(|v| v.is_finite()) && self.w > 0.0 && self.h > 0.0
+    }
+}
+
+/// How much of the title bar must stay over the work area at least, to grab it.
+pub const REACHABLE: f32 = 100.0;
+/// The size a window gets when its saved geometry is unusable, before it is fitted to the screen.
+pub const DEFAULT_SIZE: (f32, f32) = (1600.0, 1000.0);
+
+/// `window` moved and shrunk so that it can be reached on `work`: no larger than the work area
+/// (but not below `min`), the title bar not above the work area's top, the window not below its
+/// bottom, and at least [`REACHABLE`] of it over the work area horizontally. A window that is
+/// fine is returned unchanged. Geometry that makes no sense (not finite, empty), or a work
+/// area that does not, gives the default size centred on the work area.
+pub fn fit(window: Area, work: Area, min: (f32, f32)) -> Area {
+    if !work.sane() {
+        return window;
+    }
+    let min = (min.0.min(work.w), min.1.min(work.h));
+    if !window.sane() {
+        let w = DEFAULT_SIZE.0.min(work.w * 0.9).max(min.0);
+        let h = DEFAULT_SIZE.1.min(work.h * 0.9).max(min.1);
+        return Area::new(work.x + (work.w - w) / 2.0, work.y + (work.h - h) / 2.0, w, h);
+    }
+    let w = window.w.clamp(min.0, work.w);
+    let h = window.h.clamp(min.1, work.h);
+    let reach = REACHABLE.min(w);
+    // A window that had to shrink goes fully onto the screen; one that fits may keep straddling two.
+    let x = if w < window.w { window.x.max(work.x).min(work.right() - w) } else { window.x.max(work.x + reach - w).min(work.right() - reach) };
+    let y = window.y.min(work.bottom() - h).max(work.y);
+    Area::new(x, y, w, h)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const WORK: Area = Area::new(0.0, 0.0, 2560.0, 1400.0);
+    const MIN: (f32, f32) = (960.0, 600.0);
+
+    #[test]
+    fn a_window_on_screen_is_left_alone() {
+        let w = Area::new(300.0, 120.0, 1600.0, 1000.0);
+        assert_eq!(fit(w, WORK, MIN), w);
+    }
+
+    #[test]
+    fn a_title_bar_above_the_top_or_under_the_taskbar_comes_back() {
+        let fitted = fit(Area::new(300.0, -400.0, 1600.0, 1000.0), WORK, MIN);
+        assert_eq!((fitted.y, fitted.h), (0.0, 1000.0));
+        let fitted = fit(Area::new(300.0, 1300.0, 1600.0, 1000.0), WORK, MIN);
+        assert_eq!(fitted.y + fitted.h, 1400.0);
+        // A taskbar at the top moves the work area down.
+        let below_bar = Area::new(0.0, 48.0, 2560.0, 1352.0);
+        assert_eq!(fit(Area::new(300.0, 0.0, 1600.0, 1000.0), below_bar, MIN).y, 48.0);
+    }
+
+    #[test]
+    fn a_window_from_a_monitor_that_is_gone_keeps_a_grabbable_part_on_screen() {
+        let right = fit(Area::new(5000.0, 100.0, 1600.0, 1000.0), WORK, MIN);
+        assert_eq!(right.x, 2560.0 - REACHABLE);
+        let left = fit(Area::new(-4000.0, 100.0, 1600.0, 1000.0), WORK, MIN);
+        assert_eq!(left.x + left.w, REACHABLE);
+    }
+
+    #[test]
+    fn a_window_larger_than_the_screen_shrinks_to_it() {
+        let small = Area::new(0.0, 0.0, 1280.0, 720.0);
+        let fitted = fit(Area::new(-20.0, -30.0, 3200.0, 2000.0), small, MIN);
+        assert_eq!(fitted, small);
+        // Never below the minimum, unless the screen itself is smaller.
+        assert_eq!(fit(Area::new(0.0, 0.0, 100.0, 100.0), WORK, MIN).w, 960.0);
+        assert_eq!(fit(Area::new(0.0, 0.0, 100.0, 100.0), Area::new(0.0, 0.0, 800.0, 500.0), MIN).h, 500.0);
+    }
+
+    #[test]
+    fn unusable_geometry_is_centred_at_a_sensible_size() {
+        for bad in [Area::new(f32::NAN, 0.0, 1600.0, 1000.0), Area::new(0.0, 0.0, 0.0, 0.0), Area::new(0.0, 0.0, f32::INFINITY, 10.0)] {
+            let fitted = fit(bad, WORK, MIN);
+            assert_eq!(fitted, Area::new(480.0, 200.0, 1600.0, 1000.0));
+        }
+        let small = Area::new(100.0, 50.0, 1366.0, 728.0);
+        let fitted = fit(Area::new(f32::NAN, 0.0, 1.0, 1.0), small, MIN);
+        assert!(fitted.w <= small.w && fitted.h <= small.h && fitted.x >= small.x && fitted.y >= small.y);
+        // No work area to go by: nothing to change.
+        let w = Area::new(1.0, 2.0, 3.0, 4.0);
+        assert_eq!(fit(w, Area::new(0.0, 0.0, 0.0, 0.0), MIN), w);
+    }
+}

assets/README.md

@@ -84,7 +84,7 @@ The CLI still supports arbitrary PNG/ICO exports with `solidcraft-cli icon`.
 ## Code and provenance
 
 Resources remain compiled by their owning layer through existing APIs:
-`ui-egui::icons::paint` and `Tokens` at L5, model presets in L2 `doc`, and sketch
+`ui-egui::icons::paint_icon` and `Tokens` at L5, model presets in L2 `doc`, and sketch
 fonts at L1. State, projection, interaction, commands and GPU bindings stay in
 their current modules. Embedded data uses `CARGO_MANIFEST_DIR`; application code
 needs no runtime resource registry or repository lookup.

assets/appearances/opaque_finishes.rs

@@ -0,0 +1,11 @@
+//! Original illustrative opaque finishes; not measured optical or engineering data.
+//! (name, sRGB color, metal fraction, perceptual roughness). IOR is an illustrative 1.5.
+//! Separate names preserve the scalar library's appearance and saved assignments.
+pub const OPAQUE_FINISHES: [(&str, [u8; 3], f64, f64); 6] = [
+    ("Steel - Satin PBR", [158, 164, 172], 1.0, 0.4),
+    ("Aluminum - Satin PBR", [204, 208, 214], 1.0, 0.3),
+    ("Copper - Clean PBR", [204, 122, 80], 1.0, 0.25),
+    ("ABS - Molded PBR", [222, 222, 216], 0.0, 0.4),
+    ("PLA - Smooth PBR", [110, 160, 222], 0.0, 0.35),
+    ("Wood - Oak Uniform PBR Preview", [190, 146, 92], 0.0, 0.65),
+];

assets/appearances/starter_pack.rs

@@ -0,0 +1,292 @@
+//! Original starter visual data, MIT OR Apache-2.0. No external material library.
+use crate::appearance_pack::{Category, GlassBoundary, GlassRecipe, OpaqueRecipe, TextureAxis, TextureRecipe, VisualPreset};
+
+const WOOD: &str = "Uniform opaque preview only; grain resources/mapping are not applied";
+const SOLAR: &str = "Uniform opaque preview only; no cell grid, busbars, electricity or efficiency claim";
+const REGOLITH: &str = "Uniform opaque preview only; no granular displacement or measured lunar optical data";
+const OPAQUE: &str = "Illustrative opaque isotropic PBR; no measured alloy, polymer or engineering properties";
+
+const fn look(color: [u8; 3], metallic: f64, roughness: f64, dielectric_ior: f64) -> OpaqueRecipe {
+    OpaqueRecipe { color, metallic, roughness, dielectric_ior }
+}
+const fn maps(id: &'static str, repeat_mm: [f64; 2], grain: bool) -> Option<TextureRecipe> {
+    Some(TextureRecipe { id, repeat_mm, grain_axis: if grain { Some(TextureAxis::V) } else { None } })
+}
+const fn glass(transmission_linear_rgb: [f64; 3], ior: f64, reference_path_mm: f64, boundary: GlassBoundary) -> GlassRecipe {
+    GlassRecipe { transmission_linear_rgb, dielectric_ior: ior, reference_path_mm, boundary }
+}
+
+pub const STARTER_PACK: [VisualPreset; 40] = [
+    VisualPreset::opaque(
+        "starter.wood.oak-honey",
+        "Wood - Honey Oak Uniform Preview",
+        Category::Wood,
+        look([190, 145, 88], 0.0, 0.64, 1.5),
+        WOOD,
+        maps("starter.wood.oak-honey.maps-v1", [120.0, 240.0], true),
+    ),
+    VisualPreset::opaque(
+        "starter.wood.oak-smoked",
+        "Wood - Smoked Oak Uniform Preview",
+        Category::Wood,
+        look([91, 72, 55], 0.0, 0.68, 1.5),
+        WOOD,
+        maps("starter.wood.oak-smoked.maps-v1", [120.0, 240.0], true),
+    ),
+    VisualPreset::opaque(
+        "starter.wood.walnut-dark",
+        "Wood - Dark Walnut Uniform Preview",
+        Category::Wood,
+        look([99, 66, 43], 0.0, 0.60, 1.5),
+        WOOD,
+        maps("starter.wood.walnut-dark.maps-v1", [100.0, 220.0], true),
+    ),
+    VisualPreset::opaque(
+        "starter.wood.maple-light",
+        "Wood - Light Maple Uniform Preview",
+        Category::Wood,
+        look([221, 192, 141], 0.0, 0.57, 1.5),
+        WOOD,
+        maps("starter.wood.maple-light.maps-v1", [100.0, 200.0], true),
+    ),
+    VisualPreset::opaque(
+        "starter.wood.cherry-warm",
+        "Wood - Warm Cherry Uniform Preview",
+        Category::Wood,
+        look([164, 99, 65], 0.0, 0.58, 1.5),
+        WOOD,
+        maps("starter.wood.cherry-warm.maps-v1", [110.0, 220.0], true),
+    ),
+    VisualPreset::opaque(
+        "starter.wood.ash-pale",
+        "Wood - Pale Ash Uniform Preview",
+        Category::Wood,
+        look([209, 186, 146], 0.0, 0.70, 1.5),
+        WOOD,
+        maps("starter.wood.ash-pale.maps-v1", [120.0, 260.0], true),
+    ),
+    VisualPreset::opaque(
+        "starter.wood.birch-cream",
+        "Wood - Cream Birch Uniform Preview",
+        Category::Wood,
+        look([228, 206, 163], 0.0, 0.63, 1.5),
+        WOOD,
+        maps("starter.wood.birch-cream.maps-v1", [100.0, 200.0], true),
+    ),
+    VisualPreset::opaque(
+        "starter.wood.teak-golden",
+        "Wood - Golden Teak Uniform Preview",
+        Category::Wood,
+        look([167, 122, 66], 0.0, 0.61, 1.5),
+        WOOD,
+        maps("starter.wood.teak-golden.maps-v1", [110.0, 250.0], true),
+    ),
+    VisualPreset::opaque(
+        "starter.metal.carbon-steel-polished",
+        "Metal - Polished Carbon Steel",
+        Category::Metal,
+        look([161, 166, 173], 1.0, 0.16, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.metal.stainless-soft-satin",
+        "Metal - Soft Satin Stainless",
+        Category::Metal,
+        look([187, 193, 201], 1.0, 0.36, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.metal.aluminum-bead-blast",
+        "Metal - Bead Blast Aluminum",
+        Category::Metal,
+        look([195, 201, 210], 1.0, 0.58, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.metal.aluminum-silver-polish",
+        "Metal - Silver Polish Aluminum",
+        Category::Metal,
+        look([218, 224, 232], 1.0, 0.13, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.metal.copper-aged-warm",
+        "Metal - Warm Aged Copper",
+        Category::Metal,
+        look([171, 95, 57], 1.0, 0.48, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.metal.brass-champagne",
+        "Metal - Champagne Satin Brass",
+        Category::Metal,
+        look([205, 173, 102], 1.0, 0.32, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.metal.bronze-dark-cast",
+        "Metal - Dark Cast Bronze",
+        Category::Metal,
+        look([133, 95, 58], 1.0, 0.66, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.metal.titanium-matte",
+        "Metal - Matte Gray Titanium",
+        Category::Metal,
+        look([147, 149, 157], 1.0, 0.53, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.metal.gold-warm",
+        "Metal - Warm Reflective Gold",
+        Category::Metal,
+        look([235, 190, 82], 1.0, 0.18, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.metal.silver-cool",
+        "Metal - Cool Reflective Silver",
+        Category::Metal,
+        look([225, 230, 237], 1.0, 0.12, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.plastic.abs-charcoal",
+        "Plastic - Charcoal ABS",
+        Category::Plastic,
+        look([43, 45, 48], 0.0, 0.44, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.plastic.abs-warm-white",
+        "Plastic - Warm White ABS",
+        Category::Plastic,
+        look([232, 229, 220], 0.0, 0.40, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque("starter.plastic.pla-coral", "Plastic - Coral PLA", Category::Plastic, look([218, 99, 83], 0.0, 0.43, 1.5), OPAQUE, None),
+    VisualPreset::opaque(
+        "starter.plastic.petg-cyan-opaque",
+        "Plastic - Opaque Cyan PETG",
+        Category::Plastic,
+        look([36, 148, 167], 0.0, 0.29, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.plastic.nylon-ivory",
+        "Plastic - Ivory Nylon",
+        Category::Plastic,
+        look([220, 213, 190], 0.0, 0.62, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.plastic.pc-graphite-opaque",
+        "Plastic - Opaque Graphite PC",
+        Category::Plastic,
+        look([70, 76, 84], 0.0, 0.27, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.plastic.hdpe-natural-opaque",
+        "Plastic - Opaque Natural HDPE",
+        Category::Plastic,
+        look([221, 222, 207], 0.0, 0.48, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque("starter.plastic.pom-black", "Plastic - Black POM", Category::Plastic, look([29, 31, 35], 0.0, 0.32, 1.5), OPAQUE, None),
+    VisualPreset::opaque(
+        "starter.plastic.tpu-matte-black",
+        "Plastic - Matte Black TPU",
+        Category::Plastic,
+        look([31, 30, 32], 0.0, 0.83, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.plastic.peek-amber-opaque",
+        "Plastic - Opaque Amber PEEK",
+        Category::Plastic,
+        look([157, 119, 62], 0.0, 0.51, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::glass(
+        "starter.glass.clear-soda-lime",
+        "Glass Recipe - Clear Soda Lime",
+        glass([0.92, 0.98, 0.96], 1.52, 3.0, GlassBoundary::Closed),
+    ),
+    VisualPreset::glass("starter.glass.low-iron-clear", "Glass Recipe - Low Iron Clear", glass([0.98, 0.99, 1.0], 1.50, 4.0, GlassBoundary::Closed)),
+    VisualPreset::glass("starter.glass.smoky-neutral", "Glass Recipe - Smoky Neutral", glass([0.35, 0.38, 0.42], 1.52, 3.0, GlassBoundary::Closed)),
+    VisualPreset::glass("starter.glass.amber-tint", "Glass Recipe - Amber Tint", glass([0.84, 0.38, 0.08], 1.51, 3.0, GlassBoundary::Closed)),
+    VisualPreset::glass("starter.glass.cobalt-blue", "Glass Recipe - Cobalt Blue", glass([0.06, 0.14, 0.76], 1.53, 3.0, GlassBoundary::Closed)),
+    VisualPreset::glass(
+        "starter.glass.thin-clear",
+        "Glass Recipe - Thin Clear Sheet",
+        glass([0.95, 0.98, 0.99], 1.50, 2.0, GlassBoundary::Thin { thickness_mm: 2.0 }),
+    ),
+    VisualPreset::opaque(
+        "starter.solar.mono-blue",
+        "Solar Panel - Mono Blue Uniform Preview",
+        Category::Solar,
+        look([20, 41, 85], 0.0, 0.20, 1.5),
+        SOLAR,
+        maps("starter.solar.mono-blue.maps-v1", [160.0, 160.0], false),
+    ),
+    VisualPreset::opaque(
+        "starter.solar.thin-film-dark",
+        "Solar Panel - Dark Thin Film Uniform Preview",
+        Category::Solar,
+        look([28, 33, 42], 0.0, 0.28, 1.5),
+        SOLAR,
+        maps("starter.solar.thin-film-dark.maps-v1", [100.0, 200.0], false),
+    ),
+    VisualPreset::opaque(
+        "starter.regolith.mare-charcoal",
+        "Regolith - Mare Charcoal Uniform Preview",
+        Category::Regolith,
+        look([56, 56, 55], 0.0, 0.97, 1.5),
+        REGOLITH,
+        maps("starter.regolith.mare-charcoal.maps-v1", [200.0, 200.0], false),
+    ),
+    VisualPreset::opaque(
+        "starter.regolith.highland-pale",
+        "Regolith - Highland Pale Uniform Preview",
+        Category::Regolith,
+        look([116, 113, 106], 0.0, 0.93, 1.5),
+        REGOLITH,
+        maps("starter.regolith.highland-pale.maps-v1", [200.0, 200.0], false),
+    ),
+    VisualPreset::opaque(
+        "starter.regolith.dust-neutral",
+        "Regolith - Neutral Dust Uniform Preview",
+        Category::Regolith,
+        look([86, 85, 81], 0.0, 1.0, 1.5),
+        REGOLITH,
+        maps("starter.regolith.dust-neutral.maps-v1", [150.0, 150.0], false),
+    ),
+    VisualPreset::opaque(
+        "starter.regolith.agglutinate-dark",
+        "Regolith - Dark Agglutinate Uniform Preview",
+        Category::Regolith,
+        look([66, 63, 60], 0.0, 0.89, 1.5),
+        REGOLITH,
+        maps("starter.regolith.agglutinate-dark.maps-v1", [200.0, 200.0], false),
+    ),
+];

assets/fonts/ibm-plex-mono/OFL.txt

@@ -0,0 +1,93 @@
+Copyright © 2017 IBM Corp. with Reserved Font Name "Plex"
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+
+This license is copied below, and is also available with a FAQ at: http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

assets/fonts/ibm-plex-sans/OFL.txt

@@ -0,0 +1,93 @@
+Copyright © 2017 IBM Corp. with Reserved Font Name "Plex"
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+
+This license is copied below, and is also available with a FAQ at: http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

assets/icons/app/shared/source/app_icon.rs

@@ -1,88 +1,93 @@
-//! Original SolidCraft mark, shared by desktop, packaging and CLI.
+//! Original SolidCraft mark, shared by desktop, packaging and CLI: the borderless mark, five
+//! faces with transparent gaps between them, drawn from the macOS icon's
+//! `macos/source/SolidCraft.icon/Assets/03-solid-blue-cutout.svg`.
+type P = (f32, f32);
+
+/// One face in that SVG's units: its outline, and its linear gradient from one point and
+/// colour to another.
+struct Face {
+    outline: &'static [P],
+    from: (P, [u8; 3]),
+    to: (P, [u8; 3]),
+}
+
+const FACES: [Face; 5] = [
+    // Inner side of the upper step.
+    Face {
+        outline: &[(547.883, 282.66), (709.797, 188.211), (709.797, 375.985)],
+        from: ((619.14, 179.734), [29, 99, 198]),
+        to: ((694.687, 396.761), [21, 73, 158]),
+    },
+    // Top of the lower step.
+    Face {
+        outline: &[(727.797, 593.626), (727.797, 407.136), (889.571, 500.381)],
+        from: ((619.14, 413.244), [69, 159, 255]),
+        to: ((790.839, 605.547), [35, 121, 231]),
+    },
+    // Right face, with the recess.
+    Face {
+        outline: &[(530.0, 521.17), (691.797, 427.912), (691.797, 655.928), (907.594, 531.545), (907.594, 740.159), (530.0, 957.8)],
+        from: ((632.876, 399.508), [27, 102, 207]),
+        to: ((783.971, 968.175), [18, 69, 150]),
+    },
+    // Left face, stepped.
+    Face {
+        outline: &[(116.406, 510.769), (116.406, 303.529), (494.0, 521.17), (494.0, 957.8), (314.203, 854.167), (314.203, 624.777)],
+        from: ((207.063, 303.357), [37, 141, 245]),
+        to: ((426.837, 968.175), [20, 97, 218]),
+    },
+    // Top of the extruded profile.
+    Face {
+        outline: &[(134.374, 272.334), (512.0, 53.364), (691.828, 157.015), (476.117, 282.846), (673.752, 396.761), (512.0, 489.993)],
+        from: ((385.63, 53.364), [81, 173, 255]),
+        to: ((522.989, 510.769), [43, 131, 241]),
+    },
+];
+
+/// The mark's extent in SVG units: left, top, width, height.
+const BOUNDS: (f32, f32, f32, f32) = (116.406, 53.364, 791.188, 904.436);
+
 /// This block is the icon image data
 pub fn rgba(size: usize) -> Result<Vec<u8>, String> {
     if !(1..=2048).contains(&size) {
         return Err("icon size must be 1..=2048".into());
     }
-    type P = (f32, f32);
     // Coverage buffer at 4x4 samples per pixel (2x2 for big sizes), averaged down at the end.
     let ss = if size > 512 { 2 } else { 4 };
     let n = size * ss;
     let mut buf = vec![[0u8; 4]; n * n];
-    let s = n as f32 / 412.217; // SVG units -> samples: the logo fills the height
-    let ox = (n as f32 - 357.0 * s) / 2.0; // and is centred sideways
-    // Fill a convex polygon given in SVG units.
-    let mut fill = |pts: &[P], col: [u8; 3]| {
-        let v: Vec<P> = pts.iter().map(|p| (ox + p.0 * s, p.1 * s)).collect();
+    let (bx, by, bw, bh) = BOUNDS;
+    let s = n as f32 / bh; // SVG units -> samples: the mark fills the height
+    let (ox, oy) = ((n as f32 - bw * s) / 2.0 - bx * s, -by * s); // and is centred sideways
+    // Fill each face's outline (even-odd spans per row, so concave outlines work) with its gradient.
+    for face in &FACES {
+        let v: Vec<P> = face.outline.iter().map(|p| (ox + p.0 * s, oy + p.1 * s)).collect();
+        let (((fx, fy), c0), ((tx, ty), c1)) = (face.from, face.to);
+        let (gx, gy) = (tx - fx, ty - fy);
+        let g2 = gx * gx + gy * gy;
         let (top, bottom) = v.iter().fold((f32::MAX, f32::MIN), |(a, b), p| (a.min(p.1), b.max(p.1)));
+        let mut xs = Vec::with_capacity(v.len());
         for y in ((top - 0.5).ceil() as i32).max(0)..=((bottom - 0.5).floor() as i32).min(n as i32 - 1) {
             let cy = y as f32 + 0.5;
-            let (mut lo, mut hi) = (f32::MAX, f32::MIN);
+            xs.clear();
             for i in 0..v.len() {
                 let (a, b) = (v[i], v[(i + 1) % v.len()]);
                 if (a.1 <= cy) != (b.1 <= cy) {
-                    let x = a.0 + (cy - a.1) / (b.1 - a.1) * (b.0 - a.0);
-                    lo = lo.min(x);
-                    hi = hi.max(x);
+                    xs.push(a.0 + (cy - a.1) / (b.1 - a.1) * (b.0 - a.0));
                 }
             }
-            if lo > hi {
-                continue;
-            }
-            for x in ((lo - 0.5).ceil() as i32).max(0)..=((hi - 0.5).floor() as i32).min(n as i32 - 1) {
-                buf[y as usize * n + x as usize] = [col[0], col[1], col[2], 255];
+            xs.sort_by(f32::total_cmp);
+            for &[from, to] in xs.as_chunks::<2>().0 {
+                for x in ((from - 0.5).ceil() as i32).max(0)..=((to - 0.5).floor() as i32).min(n as i32 - 1) {
+                    // The sample's place along the gradient, in SVG units.
+                    let (px, py) = ((x as f32 + 0.5 - ox) / s, (cy - oy) / s);
+                    let t = (((px - fx) * gx + (py - fy) * gy) / g2).clamp(0.0, 1.0);
+                    let mix = |k: usize| (f32::from(c0[k]) + (f32::from(c1[k]) - f32::from(c0[k])) * t).round() as u8;
+                    buf[y as usize * n + x as usize] = [mix(0), mix(1), mix(2), 255];
+                }
             }
         }
-    };
-    // Faces: each is a few overlapping convex pieces (the filler only does convex shapes).
-    let (light, mid, dark) = ([96, 158, 236], [58, 136, 238], [55, 108, 197]);
-    fill(&[(3.5, 105.9), (177.0, 5.8), (263.4, 55.6), (263.8, 156.0), (177.0, 406.4)], light);
-    fill(&[(177.0, 206.1), (263.8, 156.0), (350.5, 206.2), (350.5, 306.3), (177.0, 406.4)], light);
-    fill(&[(3.5, 105.9), (177.0, 206.1), (177.0, 406.4)], mid);
-    fill(&[(3.5, 105.9), (3.5, 205.7), (90.3, 256.2), (177.0, 206.1)], mid);
-    fill(&[(177.0, 206.1), (90.3, 256.2), (90.0, 356.2), (177.0, 406.4)], mid);
-    fill(&[(264.1, 155.8), (177.0, 206.1), (177.0, 406.4), (263.8, 256.2)], dark);
-    fill(&[(263.8, 256.2), (350.5, 206.2), (350.5, 306.3), (177.0, 406.4)], dark);
-    fill(&[(177.0, 206.1), (177.0, 406.4), (350.5, 306.3)], dark);
-    fill(&[(263.8, 55.9), (263.8, 156.0), (177.1, 105.9)], dark);
-    // White edge lines, 10 units wide: a rectangle per segment and a disc at each inner corner.
-    let white = [255, 255, 255];
-    let mut stroke = |pts: &[P], closed: bool| {
-        let m = pts.len();
-        for i in 0..(if closed { m } else { m - 1 }) {
-            let (a, b) = (pts[i], pts[(i + 1) % m]);
-            let l = ((b.0 - a.0).powi(2) + (b.1 - a.1).powi(2)).sqrt();
-            let (nx, ny) = (-(b.1 - a.1) / l * 5.0, (b.0 - a.0) / l * 5.0);
-            fill(&[(a.0 + nx, a.1 + ny), (b.0 + nx, b.1 + ny), (b.0 - nx, b.1 - ny), (a.0 - nx, a.1 - ny)], white);
-        }
-        for c in &pts[if closed { 0 } else { 1 }..if closed { m } else { m - 1 }] {
-            let disc: Vec<P> = (0..16)
-                .map(|k| {
-                    let t = k as f32 * std::f32::consts::TAU / 16.0;
-                    (c.0 + 5.0 * t.cos(), c.1 + 5.0 * t.sin())
-                })
-                .collect();
-            fill(&disc, white);
-        }
-    };
-    stroke(&[(263.8, 55.9), (177.1, 105.9), (263.8, 156.0), (263.8, 256.2), (350.6, 206.1)], false);
-    stroke(&[(5.0, 105.9), (178.5, 206.1), (178.5, 406.4)], false);
-    stroke(&[(177.0, 206.1), (263.8, 156.0)], false);
-    stroke(
-        &[
-            (178.5, 5.8),
-            (5.0, 105.9),
-            (5.0, 206.1),
-            (91.7, 256.2),
-            (91.7, 356.4),
-            (178.5, 406.4),
-            (352.0, 306.3),
-            (352.0, 206.1),
-            (265.2, 156.0),
-            (265.2, 55.9),
-        ],
-        true,
-    );
+    }
     // Average each ss x ss block down to one pixel (straight alpha = covered share).
     let mut rgba = Vec::with_capacity(size * size * 4);
     for y in 0..size {
@@ -123,4 +128,20 @@ mod tests {
         assert!(super::rgba(0).is_err());
         assert!(super::rgba(2049).is_err());
     }
+
+    /// Borderless: no white edge lines, and the gaps between faces are see-through. At 256 px
+    /// the gap between the left and right faces (SVG x 494..530) is transparent on the row
+    /// through the middle of the mark, and no opaque pixel is white.
+    #[test]
+    fn shared_mark_is_borderless() {
+        let size = 256;
+        let pixels = super::rgba(size).expect("valid size");
+        let px = |x: usize, y: usize| pixels.as_chunks::<4>().0[y * size + x];
+        let s = size as f32 / 904.436;
+        let gap_x = ((size as f32 - 791.188 * s) / 2.0 + (512.0 - 116.406) * s) as usize;
+        let row = ((750.0 - 53.364) * s) as usize;
+        assert_eq!(px(gap_x, row)[3], 0, "the seam between the left and right faces is a gap");
+        assert!(px(gap_x - 8, row)[3] == 255 && px(gap_x + 8, row)[3] == 255, "faces on both sides of the gap");
+        assert!(pixels.as_chunks::<4>().0.iter().all(|p| p[3] == 0 || p[0] < 200), "no white edges");
+    }
 }

assets/icons/ui/AGENTS.md

@@ -29,3 +29,9 @@ request files under target, and do not retry them. The server never invokes a mo
 
 Canonical paths, launch command and export schema: [README.md](README.md).
 There are no numbered bulk authoring scripts or generated inventory files to maintain.
+
+Runtime discovery is also checked by `crates/ui-egui/tests/icon_audit.rs`. New menu
+surfaces must extend that Harness traversal. Regenerate the committed
+`design/requested_icons.txt` with `UPDATE_ICON_MANIFEST=1 cargo test -p
+solidcraft-ui-egui --test icon_audit`; review the sorted id/placeholder diff. The
+review tool reads this fixture in addition to source scans, masters and aliases.

assets/icons/ui/README.md

@@ -18,8 +18,8 @@ artwork changes trigger the live revision check. The server binds only to loopba
 
 Every opening scans SVG masters, aliases and source references. New, unused,
 missing and changed icons are discoverable. **All discovered icons without a valid
-acceptance are Open, including those with notes.** No inventory file or allowlist
-is needed. Rescan sees additions immediately; a running page also polls revisions.
+acceptance are Open, including those with notes.** Discovery also reads `design/requested_icons.txt`, the sorted runtime audit
+manifest; it supplements source scans and never restricts discovery. Rescan sees additions immediately; a running page also polls revisions.
 The internal placeholder glyph is the only excluded card. Shared masters are shown
 separately even when an accepted alias already uses them; reopen that alias before
 requesting a redraw of its protected artwork. Unassigned commands
@@ -82,6 +82,7 @@ Palette changes preserve accepted artwork and never update review hashes.
 | `design/palette.toml`, `aliases.toml` | Shared theme roles, weights and semantic aliases |
 | `design/review.json` | Owner acceptance hashes and current notes |
 | `design/references.toml` | Curated style references; does not control discovery |
+| `design/requested_icons.txt` | Sorted runtime requests and placeholder flags, checked by the Harness audit |
 | `design/tools/author/{lib,bases}.py` | Reusable geometry and canonical cube/slab/arrow bases |
 | `design/tools/author/new_icon.py` | Safe new-master scaffold, never overwrites an id |
 | `design/tools/icon_status.py`, `review_state.py` | Discovery, review backend and state |
@@ -90,7 +91,7 @@ Palette changes preserve accepted artwork and never update review hashes.
 | `source/` | Rust viewport glyphs, markers, navigation and pointer; not command icons |
 
 `crates/ui-egui/build.rs` embeds SVGs, palette and aliases. `icon_svg.rs` parses and
-rasterises them for `icons::paint`; adding an icon still requires its registry or
+rasterises them for `icons::paint_icon`; adding an icon still requires its registry or
 UI assignment and an application rebuild. Review status never controls rendering.
 
 ## Checks and reports
@@ -104,5 +105,25 @@ python3 -B assets/icons/ui/design/tools/icon_status.py --csv
 ```
 
 Reports, screenshots, requests, generated contact sheets and previews stay under
-ignored `target/`. Do not commit generated inventories or historical authoring
-batches. Every non-Markdown resource has an exact row in `ATTRIBUTION.md`.
+ignored `target/`. The runtime request manifest is a committed regression fixture; other generated
+inventories and historical authoring batches do not belong in the repository. Every non-Markdown resource has an exact row in `ATTRIBUTION.md`.
+
+## Runtime menu audit
+
+`cargo test -p solidcraft-ui-egui --test icon_audit` drives the real UI through the
+headless scenario Harness and rejects placeholder requests and unexpected blank
+context-menu icons. It compares sorted requested ids with
+`design/requested_icons.txt` (`id<TAB>placeholder`, one per line). After deliberately
+changing menu coverage or assignments, regenerate and review its diff:
+
+```sh
+UPDATE_ICON_MANIFEST=1 cargo test -p solidcraft-ui-egui --test icon_audit
+```
+
+The review page includes every manifest id, even ids used only in tables or helper
+arguments. A true placeholder flag, missing master or broken alias is reported as
+missing; runtime collection never changes acceptance hashes. The live control
+method `ui.icon_audit` can diagnose requests in a running UI (see
+[control protocol](../../../docs/control-protocol.md)). Keep the Harness traversal
+current when adding menus. A successful traversal covers only the contexts it
+actually opens; document unreachable or untested contexts in the audit report.

assets/icons/ui/STYLE_GUIDE.md

@@ -78,7 +78,7 @@ Its projected circle uses the same axes; do not arbitrarily flatten the ellipse.
 
 Only use the stable `source` identifiers below in model SVGs. The renderer maps roles to
 light/dark theme values. `currentColor` is the background line-art role, not a way
-to add arbitrary colours. All values and accents come from `design/palette.toml`.
+to add arbitrary colours. Default display values and semantic accents come from `design/palette.toml`. Theme files may override those display roles and ramps through `icon_palette`; source identifiers and accent assignments stay unchanged.
 
 | Role | Author helper | Light value | Use |
 | --- | --- | --- | --- |
@@ -96,9 +96,9 @@ The source hexes identify paint roles, not the displayed colour. **Never recolou
 SVG to apply a workspace accent.** Keep these identifiers and every finished shape
 unchanged; the runtime and review page resolve them through `design/palette.toml`.
 
-That file is the single colour authority: edit `light`/`dark` in the relevant
+That file is the default colour authority: edit `light`/`dark` in the relevant
 `accents` ramp; `active-3` is its primary stroke and `active-1/2` are shaded faces.
-Do not edit a role's `source` identifier. `variants` holds colour-vision adjustments.
+Do not edit a role's `source` identifier. Theme `icon_palette` overrides affect display colours only; colour-vision variants still take precedence. `variants` holds colour-vision adjustments.
 A role with `use = "active-3"` follows that stroke automatically.
 
 | Meaning | Accent | Assignment |
@@ -207,3 +207,9 @@ All artwork must be original SolidCraft work or an explicitly licensed resource
 with provenance. Commercial CAD artwork, screenshots and extracted assets are
 forbidden even as hidden references. This guide and the local finished set provide
 all required visual context for future agents.
+
+Runtime discovery is also checked by `crates/ui-egui/tests/icon_audit.rs`. New menu
+surfaces must extend that Harness traversal. Regenerate the committed
+`design/requested_icons.txt` with `UPDATE_ICON_MANIFEST=1 cargo test -p
+solidcraft-ui-egui --test icon_audit`; review the sorted id/placeholder diff. The
+review tool reads this fixture in addition to source scans, masters and aliases.

assets/icons/ui/design/aliases.toml

@@ -29,9 +29,19 @@ ground = "c_fix"
 
 # Same finished drawing, different semantic operation. Colours live only in palette.toml.
 sketch_break = { master = "break", accent = "sketch" }
+sketch_cancel = { master = "close", accent = "sketch" }
 sketch_dxf = { master = "dxf", accent = "sketch" }
 sketch_move = { master = "move", accent = "sketch" }
 sketch_scale = { master = "scale", accent = "sketch" }
 sketch_text = { master = "text", accent = "sketch" }
 surface_fair = { master = "spline_cv", accent = "surface" }
 mesh_export = { master = "export", accent = "mesh" }
+
+# Legacy feature-history id for the same Split Body operation.
+split = "split_body"
+
+# Sketch dialog choices share the corresponding finished tool artwork.
+sketch_chamfer_equal = { master = "sketch_chamfer", accent = "sketch" }
+sketch_chamfer_two = { master = "sketch_chamfer_two_distances", accent = "sketch" }
+offset_one_side = { master = "offset", accent = "sketch" }
+bom = "list"

assets/icons/ui/design/palette.toml

@@ -10,7 +10,7 @@
 [roles.ink]        # outlines and details drawn over a face
 source = "#34465b"
 light = "#34465b"
-dark  = "#d8dfeb"
+dark  = "#1f2021"
 [roles.line]       # line art that sits directly on the UI background (SVG: currentColor)
 source = "#34465b"
 light = "#34465b"
@@ -66,13 +66,13 @@ parameters = 4.2
 
 [accents.surface.active-1]
 light = "#f1d2af"
-dark  = "#ba8f6a"
+dark  = "#cc9362"
 [accents.surface.active-2]
 light = "#c06f00"
-dark  = "#b86f04"
+dark  = "#bd750d"
 [accents.surface.active-3]
 light = "#a45000"
-dark  = "#95682d"
+dark  = "#955a0e"
 
 [accents.form.active-1]
 light = "#decff8"
@@ -85,41 +85,41 @@ light = "#7349cd"
 dark  = "#7b63a6"
 
 [accents.mesh.active-1]
-light = "#e5d99b"
-dark  = "#a9985f"
+light = "#ffec8e"
+dark  = "#ffe282"
 [accents.mesh.active-2]
-light = "#a28200"
-dark  = "#9a8100"
+light = "#bb9600"
+dark  = "#ab8f00"
 [accents.mesh.active-3]
-light = "#826700"
-dark  = "#857100"
+light = "#e0b200"
+dark  = "#c6a800"
 
 [accents.sketch.active-1]
 light = "#bfe2cc"
-dark  = "#81a28e"
+dark  = "#7ab792"
 [accents.sketch.active-2]
 light = "#439a65"
-dark  = "#459665"
+dark  = "#3a965e"
 [accents.sketch.active-3]
 light = "#057f45"
-dark  = "#27864e"
+dark  = "#128d45"
 
 [accents.constraint.active-1]
 light = "#f0cfca"
 dark  = "#b98c88"
 [accents.constraint.active-2]
 light = "#c1685f"
-dark  = "#b66b61"
+dark  = "#c27267"
 [accents.constraint.active-3]
-light = "#af4038"
-dark  = "#a05c54"
+light = "#ca473d"
+dark  = "#c16358"
 
 [accents.construction.active-1]
 light = "#ecd3b6"
-dark  = "#b19373"
+dark  = "#b99a78"
 [accents.construction.active-2]
 light = "#b8741f"
-dark  = "#b4711c"
+dark  = "#ad7023"
 [accents.construction.active-3]
 light = "#9c5600"
 dark  = "#a75d00"
@@ -134,12 +134,16 @@ dark  = "#1d7f89"
 [variants.red-green.construction.active-3]
 light = "#b97300"
 dark  = "#a75d00"
+# The constraint red stays darker than the sketch green for a weak red sense.
+[variants.red-green.constraint.active-3]
+light = "#af4038"
+dark  = "#c16358"
 [variants.blue-yellow.construction.active-3]
 light = "#b97300"
 dark  = "#c37d00"
 [variants.blue-yellow.constraint.active-3]
 light = "#af4038"
-dark  = "#986255"
+dark  = "#85554a"
 
 # Default accent by requested icon id. Explicit alias accents in aliases.toml win.
 # Deliberately not inherited from a master: ground reuses c_fix but is not a constraint.
@@ -153,9 +157,9 @@ sketch = [
   "arc3", "arc_center", "arc_slot", "arc_slot_center", "arc_tangent",
   "blend", "circle", "circle2", "circle3", "circle_tt",
   "circle_ttt", "conic", "constrainer", "dimension", "ellipse",
-  "extend", "finish", "fit_section", "include", "infinite",
+  "extend", "finish", "fit_section", "include",
   "intersect", "intersection_curve", "iso_curve", "line", "line_mid",
-  "offset", "point", "polygon", "polygon_circumscribed", "polygon_edge",
+  "offset", "offset_two_sides", "offset_symmetric", "point", "polygon", "polygon_circumscribed", "polygon_edge",
   "project", "project_surface", "rect", "rect3", "rect_center",
   "rect_rounded", "sketch", "sketch_chamfer", "sketch_chamfer_angle", "sketch_chamfer_two_distances",
   "sketch_fillet", "sketch_mirror", "slot", "slot_center", "slot_overall",
@@ -168,5 +172,5 @@ constraint = [
   "c_polygon", "c_smooth", "c_symmetry", "c_tangent",
 ]
 construction = [
-  "centerline", "construction",
+  "centerline", "construction", "infinite",
 ]

assets/icons/ui/design/requested_icons.txt

@@ -0,0 +1,283 @@
+accessibility	false
+activate	false
+align	false
+appearance	false
+arc3	false
+arc_center	false
+arc_slot	false
+arc_slot_center	false
+arc_tangent	false
+as_built	false
+assistant	false
+auto_constrain	false
+axis	false
+axis_edge	false
+axis_normal_to_face	false
+axis_through_cylinder	false
+axis_two_planes	false
+axis_two_points	false
+bendtable	false
+blend	false
+body	false
+bom	false
+boss	false
+boundary_fill	false
+bounding_solid	false
+box	false
+break	false
+bug_report	false
+c_coincident	false
+c_collinear	false
+c_concentric	false
+c_equal	false
+c_fix	false
+c_hv	false
+c_midpoint	false
+c_parallel	false
+c_perpendicular	false
+c_polygon	false
+c_smooth	false
+c_symmetry	false
+c_tangent	false
+cam	false
+camera	false
+canvas	false
+capture	false
+center_of_mass	false
+centerline	false
+chain	false
+chamfer	false
+checkpoint	false
+chevron	false
+chevron_right	false
+circle	false
+circle2	false
+circle3	false
+circle_tt	false
+circle_ttt	false
+close	false
+coil	false
+combine	false
+compare	false
+component	false
+compute	false
+configuration_table	false
+conic	false
+constrainer	false
+construction	false
+contact_all	false
+contact_new	false
+contact_off	false
+contact_sets	false
+continuity	false
+convert_sheet	false
+copy	false
+curvature_comb	false
+curvature_map	false
+cut	false
+cylinder	false
+decal	false
+delete	false
+delete_face	false
+dimension	false
+draft	false
+draft_analysis	false
+drive	false
+dxf	false
+edit	false
+ellipse	false
+emboss	false
+environment_map	false
+error	false
+explode	false
+export	false
+export_tray	false
+extend	false
+extrude	false
+eye	false
+fastener	false
+fillet	false
+finish	false
+fit	false
+fit_section	false
+flange	false
+flat	false
+fold	false
+folder	false
+frame_member	false
+gear	false
+graph	false
+ground	false
+help	false
+hem	false
+hole	false
+home	false
+import	false
+import_tray	false
+include	false
+infinite	false
+inspect	false
+interference	false
+intersect	false
+intersection_curve	false
+iso_analysis	false
+iso_curve	false
+joint	false
+joint_origin	false
+library	false
+line	false
+line_mid	false
+lip	false
+list	false
+loft	false
+lookat	false
+material	false
+measure	false
+mesh_export	false
+min_radius	false
+mirror	false
+motion_link	false
+move	false
+new	false
+normal	false
+offset	false
+offset_face	false
+open	false
+orbit	false
+origin	false
+pan	false
+params	false
+paste	false
+path_flange	false
+pattern_circ	false
+pattern_path	false
+pattern_rect	false
+perforate	false
+perspective	false
+pipe	false
+plane	false
+plane_along_path	false
+plane_angle	false
+plane_midplane	false
+plane_perpendicular	false
+plane_tangent	false
+plane_three_points	false
+plane_two_edges	false
+plastic_assign	false
+plastic_rule	false
+play	false
+plus	false
+point	false
+point_along_path	false
+point_center	false
+point_edge_plane	false
+point_three_planes	false
+point_two_edges	false
+point_vertex	false
+polygon	false
+polygon_circumscribed	false
+polygon_edge	false
+presspull	false
+project	false
+project_surface	false
+rack_pinion	false
+reach	false
+rect	false
+rect3	false
+rect_center	false
+rect_rounded	false
+redo	false
+refold	false
+rename	false
+render_image	false
+render_scene	false
+reorder	false
+replace_face	false
+rest	false
+restore	false
+revert	false
+revolve	false
+rib	false
+rigid_group	false
+rollback	false
+save	false
+scale	false
+screw	false
+section	false
+select	false
+send	false
+settings	false
+sheet_rules	false
+shell	false
+shield	false
+silhouette	false
+sketch	false
+sketch_break	false
+sketch_cancel	false
+sketch_chamfer	false
+sketch_chamfer_angle	false
+sketch_chamfer_equal	false
+sketch_chamfer_two	false
+sketch_chamfer_two_distances	false
+sketch_circ_pattern	false
+sketch_dxf	false
+sketch_fillet	false
+sketch_mirror	false
+sketch_move	false
+sketch_rect_pattern	false
+sketch_scale	false
+sketch_text	false
+slot	false
+slot_center	false
+slot_overall	false
+snap	false
+snap_fit	false
+sphere	false
+spin	false
+spline	false
+spline_cv	false
+split	false
+split_body	false
+split_face	false
+spun	false
+star	false
+status_error	false
+status_recovery	false
+style	false
+suppress	false
+surface_blend	false
+surface_boundary	false
+surface_extend	false
+surface_extrude	false
+surface_fair	false
+surface_fillet	false
+surface_loft	false
+surface_offset	false
+surface_patch	false
+surface_reverse_normal	false
+surface_revolve	false
+surface_ruled	false
+surface_stitch	false
+surface_sweep	false
+surface_thicken	false
+surface_trim	false
+surface_unstitch	false
+surface_untrim	false
+svg	false
+sweep	false
+text	false
+thread	false
+torus	false
+trace	false
+trim	false
+undo	false
+unfold	false
+update	false
+warning	false
+web	false
+ws_animate	false
+ws_design	false
+ws_drawing	false
+ws_render	false
+zebra	false
+zoom	false

assets/icons/ui/design/review.json

@@ -4,6 +4,7 @@
   "accessibility": "012aa26ece9ffa8bd6a850b7a19279c3675164b12438f5fbfe560e575c8fe2eb",
   "activate": "9d28c47dcb0b733095eadc840a30fa898a19f9cf9eee203496386546666cb1f8",
   "agent_chat": "4a9ae0e7e2c360b4858b3175674c93d096705c92318fecd481e849f3ae650bf4",
+  "agent_link": "2f20d89a0e3e9b28744910dddf7f282a1099ccd91aa160c9841c5b1d9ea9ed0f",
   "align": "05615db7dd9e4be56ae898e59a68c548b8a8447794442a9a394940651204bc4f",
   "appearance": "b3162edd92291a5ef402e8499cd52be05beb2fa7eda641163c3f6e98325de2bf",
   "arc3": "fdca3d501fd557ac989376a12e9c4fa8231fde2b455c20724d1079a466153e9c",
@@ -12,10 +13,11 @@
   "arc_slot_center": "ba93e773e06e948fcf3c6dab28df341c07d35c6a3afa33a840b261bb82bcf32b",
   "arc_tangent": "d6910c8d42878cc34617b96e26c3018f4a6e4e793443ac81f2c294f88d70fa28",
   "as_built": "0f481932deca5586a8a8ea3d707efca0747f5c59559d53830b694d3458531013",
+  "assistant": "8fac392b16b4f13c6a399c59962b97c1912282e0ec909976496959472f1d642d",
   "auto_constrain": "012e5da4ff83449f6a3a92ee2d9924998cbeea545281bdf97873710b7436183d",
-  "axis": "66ebabe43a7b1b73b59a3a03b7bd92ab54d899947d0cc2d93ad6e6aac4d76501",
+  "axis": "acdab0eb7b99b1579d64ae190082df48b65174e7b8ad3104967bcc59f6154206",
   "axis_edge": "5a65898bc38bdaaaf5b04f2c2f7556915b5b7b1fdc4de9708fcc30f64aa1ab18",
-  "axis_normal_to_face": "0824bb37e80928e9ac880af5ca5fdb3b52084af9e73db73a5a5a7bc8f1f899f7",
+  "axis_normal_to_face": "597b5b96ce787b70791133267108c5196aca09d5e3f94e7dc92199a63fe49ca6",
   "axis_through_cylinder": "804eb75631f4ee71ac8db51209237bb19d82bafd326abdc81b124b875c0874b4",
   "axis_two_planes": "80162aa79ca7baf6d60490414a4fb53d87e6f2b85e901c452875a5f3ed86d35a",
   "axis_two_points": "5064f7544ce41ae7c1f05a90c958222bbcee03723df67d34cd3e209d25a1f71f",
@@ -28,36 +30,38 @@
   "boundary_fill": "17ccb419a46c04a44ec864af968a32984dc81f6b3196a821bfff7f54141dfdd1",
   "bounding_solid": "e2deb6fff292f0f295022583ba7ddb86896eb79d9dd7268e653713b9c62f0580",
   "box": "72cd44c3c4fc5ae71242fca8c60af47371930201276df5b7db9d2f16a2739c31",
-  "break": "430582243311f304dbab397ce58c8c9aef9c78ed88d3e921a57e584ddb95d94c",
+  "break": "67a5fab332616e6d6a9aeae3bedc04ee0768179143ba34b795bdd98cea04bb24",
   "bug_report": "8cf7afbe0d3c34988fd2748de148f56a7e939fd8273ba01a79a976f879c74831",
-  "c_coincident": "32fb535b3dd7631dc2e9ea284f445ad54ea0e5c8b0e1bb27a9984c849746917d",
+  "c_coincident": "a93cc58acc5090c24c973cb558920bff4e35c8f99071135f16a115256d41bf98",
   "c_collinear": "3bcf1dc6b221a1fa9a4445ee8afc7d858dc28a5270d22d10fef86fa4997f1bdf",
   "c_concentric": "90e9b35b6186ea4fcb3debc24808f302c0bf7354b7afae86e339574ef8e5103a",
   "c_equal": "c0f50c02db7d15a6392d2178e28df5c100e67fab7732f8e8474b888d218d0673",
-  "c_fix": "b91c6af7ea9740efb8cf196409b11d16fad52c51b732a356e5f844bd4e2f08e0",
+  "c_fix": "23e2471a9d6872e83028e0e219e330cef1930a4d89456a0fefa1bda8a7e3eb81",
   "c_hv": "b5c44d60a4b03b9942fbcf3c706f797ce4dbddf9a67eb1c98d6aaf3234e9bc18",
-  "c_midpoint": "fd4efc26da1336f811a9016b02d7675af2a7c95cd1ffa2f091507b22434f5435",
+  "c_midpoint": "aaea530b8a04aa80efc99ed2cf42347a91c65b160286bae3e2882f5a0bd09a51",
   "c_parallel": "aaa80258502af091b596511662aca392546dd0d7bf69cec4db98b6e0ae7591f0",
-  "c_perpendicular": "692ba7a77cd77108c33c101386b60b7c957ce7d2202937d9696d18dcf3d4cf8e",
-  "c_polygon": "defac40b4c6ef323494f49acbb94b896502f78f6a99e750975693c602164a44b",
-  "c_smooth": "dccf5effdb8977ac04e6c437c280c83ed0f117d81b64c57fae03f5f7f7f2b9c0",
+  "c_perpendicular": "0ccf0383176ace2d4ab30c2efe853815ca1df20f2537020f369f496d8bf124b5",
+  "c_polygon": "02c76b288b42d6be8eb77f502af95bb840557f43fed3def2b1a381f6ac920375",
+  "c_smooth": "87aeb504aa330a191a8680d9eab3e86844f6d7be0a9caa10fdf0a657e76f45ee",
   "c_symmetry": "8646a7deb7447514bcc455562d8639f8b4c482df8c971fd2870c05965ce71f78",
-  "c_tangent": "a011f5d43d5e09f68de332c60c5acee737a3ebc94d107f521871225c3841a064",
+  "c_tangent": "ef8b1e502c2a939958b5e8de9ef2716442e32b2a394555eb7b51101c415b966e",
   "cam": "a35342e36ca4deae55e98c54df630b5c2da591c06d979eb2b8ce6a13f6db66d0",
   "camera": "fcd867877ea4984318dbff36a166b48682f26bb9d44e70383dde63d9a7ab87c8",
   "canvas": "512d7721f0b8b14a46f22b9588b437b0cd8c2c425330d31b3b156c0d1334bcef",
   "capture": "23ef84e50b45c06532b3e842b72f6da5498d0e6b8391e1bff55e84afa8359f37",
   "center_of_mass": "24401b1a19cb45ddb028de0acf3c9815b47abecbde9e133f473adac3d27ae346",
-  "centerline": "a1889b9092ef5a7aa9592df994b6541b53ea9afb03b2c56c7678a61df335f4d7",
+  "centerline": "850283497bad77e233f934e8effc0d0d7b01ccde83fa66f6abb539a33a8a2c80",
   "chain": "9cdc78486b5c4b5b2a378e09bbd41733eb167513f9f2bc4b1aad629dd6c4c753",
   "chamfer": "487c90ae65e87b74d7ddee7d9ce9f088b63e9b5b85c2a390364855a2649f17e8",
   "checkpoint": "a3bc0700a40b791b5f3bf176d820bdabd2cf94a526908609d50136c8d0918d6a",
   "chevron": "61887736af4b1e6bef857c4d2e3846657824e84f1c8026a56525ddba2d2a8083",
+  "chevron_right": "d28a52dcc51fd9eb988f8f83e89d74370a31100049c910a886732a48ec1342ca",
   "circle": "145544ff1cd133971f537dd247092126ef8d91a88fe31b795222e76840d0c4d0",
   "circle2": "f1b6e8e2157279cfe1e608f913b377e44a70f7555f5010298138de8a887bf586",
   "circle3": "aaf6b914e630688675abf4dcbf7d43096317881ced0e22520a4ef229013e0de2",
   "circle_tt": "94996320b671c8c48f239b8c48f1b2f1cd5cc33a7d8ea1daaa61aa9203803cae",
   "circle_ttt": "ac3c211a6fe17c3625060f695ecd93937730e2bc2dd57921bcbbcaa984b9badf",
+  "close": "5833954dfba3d70a9a3a7519f2796a7213899548b0345bd8fe8ea9a321d82be2",
   "coil": "4c549fd63506457165f53a7940cc0f3dcacdbe075e935ea299edbf4985104411",
   "combine": "f9d4211f0153779369c9da68b266c2c9a857d11bc033ff4a96ede794e470e38e",
   "compare": "c24b6c18f18413ae6f3344aaa6e04b42fae8b63e7cd1552a81398462eb68eb96",
@@ -66,7 +70,7 @@
   "configuration_table": "1a142e76b9e4cd47412a307cc0ad9b8c589bb97c8930fc445dd5bb8d74ecf707",
   "conic": "808445fd697ff76f9074e7bbf877146e634995c295dce045604991fa4cec26a0",
   "constrainer": "774cb158897eb91767541b5b1a25a46f3a731cbea0661006ce5472634ab6b0e3",
-  "construction": "ad962cbcd0aaef9167744abfd0bfe1d7ef55e48b4ff42f2b4b05f66204b58acb",
+  "construction": "f13e3851cdf7b30a7118802a1c17e8852fcb9893fd1d65c7098a5c3fc35c8396",
   "contact_all": "6ad4d245592815a3e38e70ae324ad3971ab614daba7ca3cf8fcb64cb8e2be077",
   "contact_new": "603410785fff408cc12dc72bef2f09885b694c5ddb2571c7819ae1301fb89dc6",
   "contact_off": "54dc3bd2267ebb084d8dc7efee85e9f21d8c59a57ad37b96d78095bc75e73fa0",
@@ -81,8 +85,10 @@
   "decal": "acc258e40b29ffb6b6007057f0b70f487995f573704c7ef4e4f08f209d52bddd",
   "delete": "d14203f06b8b1b87328e7f198c7aa41595e9a66b5d8a7fbd2a3ec2e35cd99afd",
   "delete_face": "dcbf8ab59bd37bd5a0cdd7a528b29c2d19daa5f3fc130ef5cff0c20034f061a4",
-  "dimension": "8246dde8b0a140d1f533c1e45f2e8b5af35c05d3504dccf50bd7e7726a93389e",
-  "dots": "aa38423c547594462f49cc355f3c9f5b41e28a7515f466a6a8cffda487ba1715",
+  "dimension": "a926b7c64bc8ca99d8d6dcbb81b95235bd3fc34fbed049aca8b01b4d1147c15d",
+  "disclosure_closed": "49a350c6f2efae78de0be96c524ebee1fd1291ea449a84224b88d37164a4e807",
+  "disclosure_open": "d13ce3f97e3e362a9904fa2bf3412f3f00e4136bc23538b92d41483961d280de",
+  "dots": "600f7ff209d93145fc938bc4f6a1e34473e6b9ee22a5b4718f133bc7da5ee58d",
   "draft": "9c0fc361cacd0ad95ccd54794f4825dfc9901a83a3de752a588faec365d0ee09",
   "draft_analysis": "eb39c0f90e9cf226da6307365a76015e900dd692dc3f0fdc8f02fe717226261f",
   "drive": "cf9e924acb2531efd5a1b90915d59f0cb532c844b754fd3a0e376ef6f706c47d",
@@ -97,7 +103,7 @@
   "export": "c8c2abf007e43e896479d78798e3976ba9eda809507c820bb38538f77db696ac",
   "extend": "28c63df352c77d02feffe44cf09fb0fc1d48f7905aaabbfa6dba601dbb70f8e8",
   "extrude": "9cc1538971c5d25467aaed23f739899d9d102fd07f86472ac3197c54ca2e1144",
-  "eye": "5d90a25f5d07e6e36a2a8faf5e2ed1425b2a787834ab2291b1b1c521057ec1c2",
+  "eye": "2449167c8410826dc1106b687c12a309d5bea8f7817b897943e80f182a163c2d",
   "fastener": "fcff4e4be50907f712e527b373771afafd92e50096fc7a4b8aba5d86448e1e42",
   "fillet": "11ec232dc111597211e3a4fe61b69616b5d28b4b1b2732052ddcd486cdfc6129",
   "filter": "4d456a56416089574bd3732fa44c0c1b27fd2478b369448808a27f0144d15d8a",
@@ -109,15 +115,15 @@
   "fold": "90344fb5e5799378117fbd79ef28a84f27fba5723af5414c4ea30a2ac3a4f21e",
   "folder": "c19f5230df45a1bda1e92e89de38bba21c91e6eca0517eb15847a7712012d1e5",
   "gear": "25a1ca48a587850da1104a46005a330873ed196246e3d04e12cf61f26ad2b0d5",
-  "graph": "25646bdf4d1a534c51e1897a8ae641a21f871ed70b24ff25652e1fe957c9fa00",
-  "ground": "b91c6af7ea9740efb8cf196409b11d16fad52c51b732a356e5f844bd4e2f08e0",
+  "graph": "7156caedd2dbfa2ae53da18b7a2204b8db66c45126859d36caf049a3fd4335a4",
+  "ground": "23e2471a9d6872e83028e0e219e330cef1930a4d89456a0fefa1bda8a7e3eb81",
   "help": "8ce4060577483dbdb510be147d2827de50ac20029354008fca55abc0c7edf05d",
   "hem": "f9b1aafbedcf3dc90c26be308814638e0095fbe31b0647092507343fa60af011",
   "hole": "f82d47751f826e08682db847a270897474661bfe9f35b6d3678f49a203172563",
   "home": "ab5f1c41d377687e4c5a808dfdccf2757b33dd43f934d44df43d6e9118176853",
   "import": "e343540eb49fdb1e53c4d54b9e60ae513b3103df6c9133048bed878e58067455",
   "include": "f5b80ad3e06e3b863fcfbe415ec912e4e09653dd519f9ac207819339fe34730f",
-  "infinite": "bff57a1c56d9b47131d7c8ff85f008a53c612c63706052e7e19d7aaea93cf5b1",
+  "infinite": "53fb781131078d2f8e71be23aa610d9f9d9c8bb79ba5f97fa397475e9ff8c3bd",
   "inspect": "d2b4644b2d5f1aa50cb576b9265e275fa91201e296c2bc79865f810067d538e9",
   "interference": "b3d729d0e822e8d95485c8ef50649847572def10d4c713fff0e073b8031c5f5d",
   "intersect": "9ab4f6551848a2be546f55502a77075bed2d3994f89d91b721eab92bcee61d61",
@@ -125,7 +131,7 @@
   "iso_analysis": "dacd34ac254ec4fbb6932350f62d4d92626d922a2bfc62d2caecdeb17303e896",
   "iso_curve": "015ff2e26346ccaf149f75cf6a0652d9201c1b23a14e6bb62625acfa599dc002",
   "joint": "72b71a608e713f6cf51a1cb84edb011d4ccbd8bfe41d917fa2a1d13345dc0b2b",
-  "joint_origin": "5b0761122eb4295ea220314e8db1efd1251e3482653d6cdcc47252d0268864a8",
+  "joint_origin": "e12529af1fce8c5ffdf746e71ce2f5db5eb170e53778469cea8fd30344291574",
   "library": "ac0b1798e4c94340f9c854daa3829371c1a9f3ffea7679d955e6cfa139cafdc8",
   "line": "cd1177ea659548f03d43c7fa7dcc209a0542b1ba4bd0153c5113576cb7a96a81",
   "line_mid": "edb8ebc463479ae9878e54b930c124153ca880270b7cf6c0e4edba6336ba2854",
@@ -139,17 +145,20 @@
   "min_radius": "92bd79b7d557aba6ddfccc76a4c6d0cfb579061b3c57172f9171d28af675711c",
   "mirror": "56637068a319dc2972c5552b25e4f43151aa9bd5055c2fef08204dd7cc0829cf",
   "moon": "3ba5adb92bf0f49e92d46682dbf6905e555aa6eebc8e2b3c5288f949cda29322",
-  "motion_link": "19698bbe15b7c2d2601208bbcdc26627d1aa7724aee017b7da8874ad87fb9d1f",
+  "motion_link": "27832f827146446557609336a9b9e48e649ed84e58c45bd9032a93abbd454104",
   "move": "4132e270ada8d0c79b477095c84d656d6d354e200c1748ce7fc425f36d0b7031",
   "nav_settings": "b93dd46d3a3d074e0d8834167f977dab417fbc1a721bc4db5e840732304e4193",
   "new": "c64c78fd8445bc7b2aa8765d0507b9adf23e35cbf52828d3f1987edccce0389f",
-  "normal": "1148cef2d60a858b69406a2e2527d4ea126f45846de7cc2fb3a96640e9ee226f",
+  "normal": "3c000d707837d4e9c865aefa43c1e610bfce5a06a38510f82e4db11fc13ab31f",
   "offset": "094607afcfdcb9c1410114d9f8d22ca367f8e32ab4c61f71affe44ad5d09adbe",
   "offset_face": "83d39308ec9f3ead78329c62841c8899bbc76ce08e17d539016d18c91d9d4ea7",
+  "offset_one_side": "094607afcfdcb9c1410114d9f8d22ca367f8e32ab4c61f71affe44ad5d09adbe",
   "offset_surface": "b501cfb56b8404cdb2275935d780ce7dbb67e87e29ade3782f0859c59070a2b1",
+  "offset_symmetric": "67f3489402af3afa055181bbdb2a32b9fe2e0d96dccbe0f28df087577978ac9c",
+  "offset_two_sides": "ef69f955c5bef15471e9d77a4498e9337bf938ad75dcbc1e95af2515b6fd13da",
   "open": "f1880d25489753f7e40390902037bbd3195fbd099a5e9dd175797d832abff727",
   "orbit": "4adcd400cdde909139386e78579433354f65f5a77a0594447bf6dda663b3b1b4",
-  "origin": "9b9360edc16ef9f059bff7d863f1bc0e3abac6acf559d76c4ea39dc374ab2844",
+  "origin": "636f9f41654a6da7a5a708bcddef85672f2d77bfec2267b0134e8c5a59768b40",
   "pan": "2465eda7a39d4458d7818f2eb2b033992a68f80d9505bff538b41eb4511bb632",
   "params": "d0d9d0b3e786880e59b985dc2e3a7d593cf3771484a8fd2924d69155195c230f",
   "paste": "e1b3c089adafacb6f7b78b86ec7aba0876b189c81d01031045dfee2c47ae8edc",
@@ -164,22 +173,23 @@
   "perspective": "5fa45ba9b75dbe9fdad9eae331ca7ff35c6ad018b8a1fc4c8ae7bcfc13ed0c3f",
   "pipe": "b9ecf1ae9f6790e2ae6c677f290446f70eba1773a10247fe33d5283b360b0403",
   "plane": "3e7fa0a9d57891f3c1ec03d7422bdb29353d3487deed12e8ec5737aeb33c2f3a",
-  "plane_along_path": "020e25969a7f4e7e3358003addee7df8b1991cde8401df0b4df8295b19497994",
+  "plane_along_path": "db4686ea02c3c3b8ad0d9eac203cc050c395cff6358358922a79c00e955e6852",
   "plane_angle": "2f0914955663b393a377fda080bc03dc5a2133d42c506c1908c53b2fd609b156",
   "plane_midplane": "66bd880821e7b122f130824313b7070d72d79168a52df6a126106b6eb5816474",
-  "plane_perpendicular": "90e1d9b8e75743821aa1082596d9c3f288ab3baddf087fbae3f2025481e58a6e",
+  "plane_perpendicular": "0055fb18ee39044bfc9f2ac53ba55fe73d8fe59e8f4cf225ee2c723a883d3085",
   "plane_tangent": "c3872b9f1d0f0b2493a5488dfdad50049c3422c29023250088eeda9bbcc6e795",
   "plane_three_points": "08e2dbaf606d165ef4f788869fc794a4fbbbb2ee86a60017b76e467af6da338a",
-  "plane_two_edges": "1588b8d4741382d9e8fec38212419ac1c05b1bc6036f276d3b5c62db66f8ebdb",
+  "plane_two_edges": "21de401ec5bab8ae37510da6fa0a6910325f858c17460da0041fd26897338d30",
   "plastic_assign": "bbfdb2d2c07629c047e8e671c7c032654668a67b4b8a934f74cbb3d7a00cc5fe",
   "plastic_rule": "51b8591d92907a3ffb76a47a0503d7ba86706d129dd990515a364dbf1ab8cb48",
   "play": "d1c17ebc16e9a4ee5ae2a8cc37b515ffcc8c53a2ab17117959e9b21278df8def",
+  "plus": "4f324157bb2348ac9f09346b669b08d66ed96cb1c694f33db6f21134f18904b5",
   "point": "fd19dbcd26e2a898267bab54b9d89779d97894209c1771317d7debef5a6f8f5d",
-  "point_along_path": "1fd58d45285fb5cabeddbd35bc8485af1b6d7f1414e302202b4e73de593d1b7a",
+  "point_along_path": "17abd16dec5f70e9f8449c927aa995cfed10fca552ec7cd8f51b209c52012595",
   "point_center": "0ad755896f7d0154a854bda16d3059da78d1fae57962e13a3bb1b31e284b7e79",
-  "point_edge_plane": "548a6c1c944caabe44ab0318e85ae82f39c11f74fbedda35f57bc6615755f249",
+  "point_edge_plane": "a277bc0b87f2dd39eb613835d0f961b3372483e22053e6a522a06c535ad530c4",
   "point_three_planes": "b33c7508ffa67b66a57b72c6ea7900e93ff16362a29d0b2688e0b1db9bfad041",
-  "point_two_edges": "35dcb67b36c8e41041cc836b01056731ab6f14c5e3b4bdd836fbee2a1dd897e3",
+  "point_two_edges": "da329241706e405b877cec20639dc0a78505ca7212c7c47ad1f1f34aa26f4666",
   "point_vertex": "649bb63caf65a3fbc00a1222cc642294832b5e5d8c4d33f812e09a70684c4abe",
   "polygon": "4919268cca7d21ce98dbf4ca01ee832350e793afe4213e257d3c46e94ea88ad1",
   "polygon_circumscribed": "7e4ad16cc1f42c599287b186f26f4ff3c108736877a571a5513bfc72d0cbb23f",
@@ -213,16 +223,19 @@
   "scale": "a66f69d9a1d46c8be30da0a15827bc7e38cba72d6271537763b888c2c7e2b3fa",
   "screw": "5e30570785360d6a591ea22862a82f1cf62228385c1e96382536db8a453ac791",
   "section": "cdd13f99f15f6d59bfa21c747810608d6afd00cb8207faf0337928c8521e7eae",
-  "select": "a0c716234ef1d599be9a7654d6b2911ebe4b2de479383ba33aeab14992443a2f",
+  "select": "fdf6431270006ca7409c60c37cfed59572de04229f104ec723e6010ffa2b7163",
   "settings": "9193dd3a1007c43660d0d47b6499cb2571338b67949e1a99df112057b9bf2b8a",
   "sheet": "774e30923ef6f37dd9c0b2bc3e45705e83b3a76700bf071cd41155a365d0daa4",
-  "sheet_rules": "b8c3a67c82be20fc00c109decc566e8755d70167e04e0a9fb92941f7b27aa993",
+  "sheet_rules": "5d3a2f37d3b4a4262b3ddbdae53d61f29e0f8e284dd54006da25a7acebfa1114",
   "shell": "a1959ea0d0441a479bf654b6e549e2e44a0bfdc9cda4eb46fe1fbfd884de7e38",
+  "silhouette": "2a848aed2f247b1c0439f830a34a513c93bc5493c40044c821d493d863ad996e",
   "sketch": "b52e5862b1709a9a7e3ca00d7436d126fbfc01b38080006fa4e17dc581dfa103",
-  "sketch_break": "430582243311f304dbab397ce58c8c9aef9c78ed88d3e921a57e584ddb95d94c",
+  "sketch_break": "67a5fab332616e6d6a9aeae3bedc04ee0768179143ba34b795bdd98cea04bb24",
   "sketch_chamfer": "80ab27a9929f9cf0ab2f827757e007173d74ddca6c19af238931c40d4cd874b4",
-  "sketch_chamfer_angle": "b853f5e7c3b008c0d56ac445a9a28f713987c919ea284945113ad35e7665e2a7",
-  "sketch_chamfer_two_distances": "2b70d658e341f4388838f3c8c579ec5f4f3a7fddcfa2ce7a3f89fc3db6422d6e",
+  "sketch_chamfer_angle": "6750268d05e0b0fd74c2d0368bf4703b09da825def668dc3dfd05deef3ba9adb",
+  "sketch_chamfer_equal": "80ab27a9929f9cf0ab2f827757e007173d74ddca6c19af238931c40d4cd874b4",
+  "sketch_chamfer_two": "1f5ecf1283e2b021e067ed2e4e2e97aa4e1ad3c7c98d8609bb81c5f811988f78",
+  "sketch_chamfer_two_distances": "1f5ecf1283e2b021e067ed2e4e2e97aa4e1ad3c7c98d8609bb81c5f811988f78",
   "sketch_circ_pattern": "c5ff904237a3072f858f66c2777febc4facd2fee630bbf979047c5685d9a05ce",
   "sketch_dxf": "dddce44d4dd10f75a221208fcf431b36b3f0cafce6611fc695ac73afb4bf5789",
   "sketch_fillet": "e8fa170e5f6899abf75788b9384d49f2b9d77ba9b644f79309284a9e65629fe1",
@@ -240,6 +253,7 @@
   "spin": "a5bebeff8276dd12ab7e42ddf0051370b9063fb602607298acf22e77044434d1",
   "spline": "a0dcb25614e5fe1a8f17bc3bddbb11b61cf82b461dd46443ab28cddd6e4e32e3",
   "spline_cv": "353f6e411c0ce611f660cef2e4fc4f8f55edc2c82288de91948dc638cd2b5f15",
+  "split": "eb9619e74c6ee1b1989d35a2e31d2d33a7adac210c4cd424e5382902945ac68b",
   "split_body": "eb9619e74c6ee1b1989d35a2e31d2d33a7adac210c4cd424e5382902945ac68b",
   "split_face": "c8b89072118bb7a28b243d38e26b81a796781a631f30b3b1fc296ba23e4d908d",
   "spun": "b4cfa093ffb43611ee124f4a39fb44c609deb9cde5e05e4dfbaf893fe197c27b",
@@ -248,7 +262,7 @@
   "status_warning": "1ac4f0ccfac2c01f6f66cb42188f9ae053c4aef9c5bbd249f1fb09611eb4d825",
   "stitch": "6c3205d64007b771ed78d6f8055867578439fb25d591563b32dbd3343c98732d",
   "style": "6c2b04234b82ea4858c80190cc7208c60f549358253005afc35ab4e29506b578",
-  "suppress": "6c033a6672a3b6ca926e3d7a75a758c9db7e1144210cd360be043a9fdf999ede",
+  "suppress": "c54fbc01c12c0175d78cd63f692e8aaf73fc2cac79752b2a3ad821ac32734343",
   "surface": "ba0e839ce0ee03e7ff95a2389a5ecb20bd80c713064d9b1bd5f461f4a80d1921",
   "surface_blend": "0642f3b4af7d22f379a3c74f54c7b1c9eef0bdda19372ce4df73c0e56bdd7bbc",
   "surface_boundary": "fb8501bae192e2416118cc2e88f544e0e29197f6720bccc541c967ca0848d8d3",
@@ -264,14 +278,14 @@
   "surface_ruled": "c3f0202d3beaacef0368765ce771eb9e3b0e3e157f86564c72d81f0fad9a3cab",
   "surface_stitch": "6c3205d64007b771ed78d6f8055867578439fb25d591563b32dbd3343c98732d",
   "surface_sweep": "6d7f18c12b2e4c1dbe3632fe08239687f6f027b29b6dddbf8c8e2d9151c7baf3",
-  "surface_thicken": "676eb73a99d708214e8951ebe2c4d88d60de2d752c725d8106d12fbd812e461a",
+  "surface_thicken": "35aaa8e4fdbcd220a3a05165d5230a7ce576fbf5a6a5772d27162ab61bb71538",
   "surface_trim": "ae269721b386bd1264184b9838df3240b5b6ba02b99c9993384ef21200fb7398",
   "surface_unstitch": "bd8302fe95a89eb6f9bbf35ef0ee98c8a2186e160cff3d091f8cf2a0a75d4473",
   "surface_untrim": "24de5d558519e0629280d11919ba5661c92ccdccdce03f8f3d83f2d7867c2173",
   "svg": "7da77d53c84db18ce95737ad633c105d1009444b3192a5e0aae76873cfc9cc12",
   "sweep": "6d7f18c12b2e4c1dbe3632fe08239687f6f027b29b6dddbf8c8e2d9151c7baf3",
   "text": "9d31b72b16644681c8a86ac257511847ad69ce4351cf6960442222e94b168c4a",
-  "thicken": "676eb73a99d708214e8951ebe2c4d88d60de2d752c725d8106d12fbd812e461a",
+  "thicken": "35aaa8e4fdbcd220a3a05165d5230a7ce576fbf5a6a5772d27162ab61bb71538",
   "thread": "158728c3dcf6623bb1584d162398bb12c28d18770e0d47f5e6328355ce31b37c",
   "torus": "5ae13fc213582e0844118b910a3a26efd9e4b177d21500363fbae230803cb4fd",
   "trace": "5f2ecc61d4591d3c3b0ecccd35296b8613fce7beb2ae214fb906160c31d89187",
@@ -283,7 +297,7 @@
   "update": "c675e16df4c78589a00be4a34f98627500681672ee8a668e929aec50982da3cc",
   "warning": "1ac4f0ccfac2c01f6f66cb42188f9ae053c4aef9c5bbd249f1fb09611eb4d825",
   "web": "be5cd95bebcd0ebe257f9eb862112124429b381ef4a2f0849938fac7c9ccc619",
-  "ws_animate": "d36a0834ad989a6e16e2b0db493ad8867c590caedf0442c51eff19e934c887f8",
+  "ws_animate": "f34f187850789cc4f141b1ace114082be04edec8e7771d6730fec1cef19c7f64",
   "ws_design": "7b1dd678a2d018892b965a78932c047bbfff6b4439d7bd9fe85c09a995f97581",
   "ws_drawing": "61e99c7179f3448a31b8c76392334352ec3d5e39b0b92fe5244940146d0986cb",
   "ws_render": "1bfe474d1742623ad2142129e4d6a40015e674813eb1db401d2e88e55b1f2a03",
@@ -291,6 +305,9 @@
   "zoom": "89c121fa85df034d70bd9f06e20cbd54d163691d4df03b13a9ac5372e951aeda"
  },
  "notes": {
-  "pattern_flip": "This feels sparse. Improve the composition"
+  "construction": "Fix the bottom dot's position",
+  "infinite": "Make the infinity symbol use the 'Line art' colour",
+  "pattern_flip": "This feels sparse. Improve the composition",
+  "sheet_rules": "Make the top line also blue"
  }
 }

assets/icons/ui/design/svg/flat/agent_link.svg

@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Connected agent</title>
+  <path d="M25 7L25 24M39 7L39 24" fill="none" stroke="currentColor" stroke-width="5" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M16 25L48 25L48 31Q48 41 38 41L36 41L36 47L28 47L28 41L26 41Q16 41 16 31Z" fill="currentColor" stroke="currentColor" stroke-width="3" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M32 47L32 57" fill="none" stroke="currentColor" stroke-width="4.25" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>

assets/icons/ui/design/svg/flat/assistant.svg

@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Assistant</title>
+  <defs>
+    <mask id="assistant-sparkle" maskUnits="userSpaceOnUse" x="-32" y="-32" width="128" height="128">
+      <path d="M-32 -32L96 -32L96 96L-32 96Z" fill="white"/>
+      <path d="M28 18.5Q30.3 27.7 39.5 30Q30.3 32.3 28 41.5Q25.7 32.3 16.5 30Q25.7 27.7 28 18.5Z" fill="black"/>
+      <path d="M43.5 15.5Q44.6 19.9 49 21Q44.6 22.1 43.5 26.5Q42.4 22.1 38 21Q42.4 19.9 43.5 15.5Z" fill="black"/>
+    </mask>
+  </defs>
+  <path d="M15 11.5L49 11.5Q55 11.5 55 17.5L55 40.5Q55 46.5 49 46.5L30 46.5L18 55L18 46.5L15 46.5Q9 46.5 9 40.5L9 17.5Q9 11.5 15 11.5Z" fill="currentColor" stroke="currentColor" stroke-width="3" stroke-linejoin="round" stroke-linecap="round" mask="url(#assistant-sparkle)"/>
+</svg>

assets/icons/ui/design/svg/flat/chevron_right.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Chevron right</title>
+  <path d="M24 16L40 32L24 48" fill="none" stroke="currentColor" stroke-width="5" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>

assets/icons/ui/design/svg/flat/close.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Close</title>
+  <path d="M19 19L45 45M45 19L19 45" fill="none" stroke="currentColor" stroke-width="5" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>

assets/icons/ui/design/svg/flat/disclosure_closed.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Disclosure closed</title>
+  <path d="M24 17L46 32L24 47Z" fill="currentColor" stroke="currentColor" stroke-width="6" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>

assets/icons/ui/design/svg/flat/disclosure_open.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Disclosure open</title>
+  <path d="M17 24L47 24L32 46Z" fill="currentColor" stroke="currentColor" stroke-width="6" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>

assets/icons/ui/design/svg/flat/export_tray.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Export Tray</title>
+  <path d="M32 38L32 10M20 22L32 10L44 22M10 43L10 54L54 54L54 43" fill="none" stroke="currentColor" stroke-width="5.6" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>